Medium · 6.1 CVE-2023-23754 EUVD-2023-27840GHSA-6wpq-rvpm-6542

[20230501] - Core - Open Redirect and XSS within the mfa select

Published May 30, 2023 · Updated Jan 10, 2025 · Assigned by Joomla

Vendor: Joomla! Project Product: Joomla! CMS Category: Web / CMS

Description

An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redirect and XSS issue within the new mfa selection screen.

Affected products

Vendor	Product	Affected	Fixed
Joomla! Project	Joomla! CMS	4.2.0-4.3.1	—

Advisories 1

WID-SEC-2023-1327 Joomla: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 30, 2023

References

https://developer.joomla.org/security-centre/899-20230501-core-open-redirects-and-xss-within-the-mfa-selection.html vendor-advisory