Joomla! 3.x < 3.9.24 Multiple Vulnerabilities

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.x prior to 3.9.24. It is, therefore, affected by multiple vulnerabilities.

• Lack of ACL checks in the orderPosition endpoint of com_modules leak names of unpublished and/or inaccessible modules. (CVE-2021-23123)

• Lack of escaping in mod_breadcrumbs aria-label attribute allows XSS attacks. (CVE-2021-23124)

• Lack of escaping of image-related parameters in multiple com_tags views cause lead to XSS attack vectors. (CVE-2021-23125)

Note that the scanner has not tested for these issues but has instead relied only on the application’s self-reported version number.