Vulnerability of Joomla versions 4.0.0-4.2.7, CISA: CVE-2023-23752

Joomla is an open-source content management system that has been around since 2005 and has been one of the most popular CMS platforms for most of this time.

Joomla is used by a variety of companies, from small businesses to large corporations, to manage websites. Using such a popular CMS has its advantages, but requires systematic tracking of updates.

Among the vulnerabilities that have appeared in the CISA (Cybersecurity and Infrastructure Security Agency)  catalog is CVE-2023-23752, for which a patch was created, however, despite this, there is a threat of active exploitation.

This vulnerability allows an attacker to gain access  to an application programming interface (API) that can be used to obtain Joomla configuration information. An attacker can create specially crafted requests that may lead to the disclosure of confidential information.

The vulnerability occurred due to improper access verification that allows unauthorized individuals to access web services endpoints that exist in Joomla version 4.0.0-4.2.7.

If  your site was created on Joomla, the above version,  we recommend that you update your CMS to version 4.2.8 or later, for example, to version 5.x.

If the database is made public, an attacker can change the password of the superadmin, i.e. the Joomla user with all the rights that may be in  the admin panel of the CMS, and gain access to the administrative interface to perform, for example: making changes to templates or installing malicious plugins, removing modules, plugins, components, or other actions.

Even if the database is not made public, it can be used to obtain information about Joomla users, which can open up opportunities for attacks on accounts.