Joomla! 2.5.x < 3.9.21 Multiple Vulnerabilities

According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.9.21. It is, therefore, affected by multiple vulnerabilities.

• Lack of escaping in mod_latestactions allows Cross-Site Scripting (XSS) attacks. (CVE-2020-24599)

• Lack of input validation in com_content leads to an open redirect. (CVE-2020-24598)

• Lack of input validation allows com_media root paths outside of the webroot. (CVE-2020-24597)

Note that the scanner has not tested for these issues but has instead relied only on the application’s self-reported version number.