5.3Medium KEV

CVE-2023-23752[20230201] - Core - Improper access check in webservice endpoints

Joomla! Project Joomla! CMS; joomla joomla\! Published: 2023-02-16 19:25 (3 years ago)

Known exploited — Joomla! Improper Access Control Vulnerability

CISA confirmed this vulnerability is used in real attacks on 08.01.2024. Remediation deadline for US federal agencies: 29.01.2024.

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://developer.joomla.org/security-centre/894-20230201-core-improper-access-check-in-webservice-endpoints.html; https://nvd.nist.gov/vuln/detail/CVE-2023-23752

Description

An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.

Weakness (CWE): CWE-284

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
joomla	joomla\!	4.0.0 – ≤ 4.2.7
Joomla! Project	Joomla! CMS	4.0.0-4.2.7

References and patches

https://developer.joomla.org/security-centre/894-20230201-core-improper-access-check-in-webservice-endpoints.html vendor-advisoryVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-23752 US Government Resource

CPE matches (NVD) (1)

cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:* ≥ 4.0.0 < 4.2.8

CVSS score

5.3Medium

Source: CISA-ADP · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: None
Availability: None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

All scores (3)

CISA-ADP	CVSS 3.1	5.3Medium
nvd	CVSS 3.1	5.3Medium
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	5.3Medium

EPSS (chance of exploitation in 30 days)

99.81%

higher than 100% of all CVEs

CISA assessment (SSVC)

Exploitation: active
Automatable: yes
Technical impact: partial

Timeline

ID reserved2023-01-17
Published2023-02-16 19:25
Reached IP-DB2026-10-24 23:31
Added to KEV2024-01-08
Last updated2026-06-17 08:37

Assigned by (CNA): Joomla
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Joomla!

7.0High

CVE-2026-90915 1 month ago

Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Project Joomla! CMS

Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -An improper validation of the cache group name allowed path traverals in the file storage of the caching layer, resulting in arbitrary d…

7.0High

CVE-2026-92226 1 month ago

Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Project Joomla! CMS

Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform edit actions on otherwise uneditable items.

5.9Medium

CVE-2026-92224 1 month ago

Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Project Joomla! CMS

Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The link toolbar layout did not properly escape inputs, leading to an XSS vector.

6.9Medium

CVE-2026-90907 1 month ago

Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3

Joomla! Project Joomla! CMS

Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites wit…

5.9Medium

CVE-2026-90914 1 month ago

Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Project Joomla! CMS

Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability in the generic audio and video output layouts.

7.1High

CVE-2026-92231 1 month ago

Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3

Joomla! Project Joomla! CMS; Joomla! Project Joomla! Framework Filter package

Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The checkAttribute method normalized an attribute value before testing it against the "javascript:" scheme regex, however…