Joomla! Security Vulnerabilities - January

CVE-2023-23752

An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.

CVE-2023-23754

An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redirect and XSS issue within the new mfa selection screen.

CVE-2023-23755

An issue was discovered in Joomla! 4.2.0 through 4.3.1. The lack of rate limiting allowed brute force attacks against MFA methods.

CVE-2023-40626

The language file parsing process could be manipulated to expose environment variables. Environment variables might contain sensible information.

CVE-2024-21729

Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field.

CVE-2024-21730

The fancyselect list field layout does not correctly escape inputs, leading to a self-XSS vector.

CVE-2024-21731

Improper handling of input could lead to an XSS vector in the StringHelper::truncate method.

CVE-2024-26278

The Custom Fields component not correctly filter inputs, leading to a XSS vector.

CVE-2024-26279

The wrapper extensions do not correctly validate inputs, leading to XSS vectors.