CVE-2023-23752: fallo de gravedad media en Joomla! CMS
[20230201] - Core - Improper access check in webservice endpoints
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
100Vexday Risk Score
Corrige ahora. Ella está bajo explotación confirmada por CISA y tiene exploit funcional público.
ssvc Actcvss 5.3epss 100%
de la publicación al arma2 días
Publicada en NVD16 feb
1ª PoC+2d
metasploit1 feb
CISA KEV+326d
Acción exigida por CISAplazo federal: 2024-01-29
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
En resumen
Joomla versiones 4.0.0 a 4.2.7 tienen un fallo que no verifica correctamente los permisos de usuarios en los endpoints de webservice, permitiendo que personas no autorizadas los accedan. Esto puede exponer datos sensibles o permitir que atacantes realicen acciones no deseadas.
Detalle técnico
Una vulnerabilidad de control de acceso inadecuado en los endpoints de webservice de Joomla (CWE-284) permite que atacantes sin autenticación o con pocos privilegios eludan verificaciones de autorización y accedan a APIs protegidas. La vulnerabilidad afecta versiones 4.0.0 a 4.2.7; la explotación requiere acceso de red a los endpoints sin verificación previa de autenticación en ciertos casos.
Resumen generado y traducido por IA a partir de la descripción oficial.
El análisis completo de esta CVE está disponible en portugués →
An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
Joomla! Project · Joomla! CMSPoCs públicas encontradas — 114✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/51334githubgithub.com/Acceis/exploit-CVE-2023-23752★ 95githubgithub.com/Ap0dexMe0/CVE-2023-23752★ 36githubgithub.com/K3ysTr0K3R/CVE-2023-23752-EXPLOIT★ 20githubgithub.com/z3n70/CVE-2023-23752★ 19githubgithub.com/keyuan15/CVE-2023-23752★ 13githubgithub.com/gibran-abdillah/CVE-2023-23752★ 8githubgithub.com/adhikara13/CVE-2023-23752★ 8githubgithub.com/Youns92/Joomla-v4.2.8---CVE-2023-23752★ 7githubgithub.com/0xNahim/CVE-2023-23752★ 6githubgithub.com/Fernando-olv/Joomla-CVE-2023-23752★ 5githubgithub.com/Sweelg/CVE-2023-23752★ 5githubgithub.com/karthikuj/CVE-2023-23752-Docker★ 5githubgithub.com/Vulnmachines/joomla_CVE-2023-23752★ 4githubgithub.com/Saboor-Hakimi/CVE-2023-23752★ 4githubgithub.com/ifacker/CVE-2023-23752-Joomla★ 4githubgithub.com/0xWhoami35/CVE-2023-23752★ 3githubgithub.com/GhostToKnow/CVE-2023-23752★ 3githubgithub.com/blacks1ph0n/CVE-2023-23752★ 3githubgithub.com/yusinomy/CVE-2023-23752★ 3githubgithub.com/ibaiw/joomla_CVE-2023-23752★ 3githubgithub.com/JohnDoeAnonITA/CVE-2023-23752★ 2githubgithub.com/r3dston3/CVE-2023-23752★ 1githubgithub.com/Pushkarup/CVE-2023-23752★ 1githubgithub.com/AlissonFaoli/CVE-2023-23752★ 1githubgithub.com/Jenderal92/Joomla-CVE-2023-23752★ 1githubgithub.com/h3x0v3rl0rd/CVE-2023-23752★ 1githubgithub.com/rvzsec/joombrute★ 1githubgithub.com/AkbarWiraN/Joomla-Scanner★ 1githubgithub.com/adriyansyah-mf/CVE-2023-23752★ 1githubgithub.com/wangking1/CVE-2023-23752-poc★ 1githubgithub.com/mariovata/CVE-2023-23752-Python★ 0githubgithub.com/gunzf0x/CVE-2023-23752★ 0githubgithub.com/Rival420/CVE-2023-23752★ 0githubgithub.com/0xx01/CVE-2023-23752★ 0githubgithub.com/Sharma01672/traveller-htb★ 0githubgithub.com/BardLaudian/CVE-2023-23752★ 0githubgithub.com/shellvik/CVE-2023-23752★ 0githubgithub.com/Ge-Per/Scanner-CVE-2023-23752★ 0githubgithub.com/JeneralMotors/CVE-2023-23752★ 0githubgithub.com/s4m98/CVE-2023-23752★ 0githubgithub.com/svaltheim/CVE-2023-23752★ 0githubgithub.com/hadrian3689/CVE-2023-23752_Joomla★ 0githubgithub.com/C1ph3rX13/CVE-2023-23752★ 0githubgithub.com/Aureum01/CVE-2023-23752★ 0githubgithub.com/Marwan651/Joomla-CMS-Full-Lifecycle-Pentest★ 0githubgithub.com/sw0rd1ight/CVE-2023-23752★ 0githubgithub.com/CyberCTF/vulhub-joomla-cve-2023-23752★ 0githubgithub.com/MrP4nda1337/CVE-2023-23752★ 0githubgithub.com/yTxZx/CVE-2023-23752★ 0githubgithub.com/Ly0kha/Joomla-CVE-2023-23752-Exploit-Script★ 0githubgithub.com/Charly-bite/SITEUR★ 0vulncheckvulncheck.com/xdb/ddf2c5d4308dno verificadovulncheckvulncheck.com/xdb/b31c59f8f715no verificadovulncheckvulncheck.com/xdb/08d79fdd2c20no verificadovulncheckvulncheck.com/xdb/d11c0b94b56fno verificadovulncheckvulncheck.com/xdb/e75f675ad853no verificadovulncheckvulncheck.com/xdb/a1a80da3e715no verificadovulncheckvulncheck.com/xdb/00f73b1a9db7no verificadovulncheckvulncheck.com/xdb/4922313e9153no verificadovulncheckvulncheck.com/xdb/2f5659875bfcno verificadovulncheckvulncheck.com/xdb/5f40cd023932no verificadovulncheckvulncheck.com/xdb/4aa5bf767299no verificadovulncheckvulncheck.com/xdb/c2d7418276e7no verificadovulncheckvulncheck.com/xdb/8a58bbcc46dfno verificadovulncheckvulncheck.com/xdb/7b3bb7626edeno verificadovulncheckvulncheck.com/xdb/73bb74556ea0no verificadovulncheckvulncheck.com/xdb/7abe8dabe0ecno verificadovulncheckvulncheck.com/xdb/bb793678a4c1no verificadovulncheckvulncheck.com/xdb/ae3ff3c0e355no verificadovulncheckvulncheck.com/xdb/14f43e8a9127no verificadovulncheckvulncheck.com/xdb/4567f3a2525dno verificadovulncheckvulncheck.com/xdb/992ddc9eaf34no verificadovulncheckvulncheck.com/xdb/a21e9dba9052no verificadovulncheckvulncheck.com/xdb/761b2b5d20c0no verificadovulncheckvulncheck.com/xdb/0c0007f3a9a4no verificadovulncheckvulncheck.com/xdb/318208166f71no verificadovulncheckvulncheck.com/xdb/a5e6c33317aeno verificadovulncheckvulncheck.com/xdb/ae30c8d7f152no verificadovulncheckvulncheck.com/xdb/0688e24d7079no verificadovulncheckvulncheck.com/xdb/d6ec7cba19cano verificadovulncheckvulncheck.com/xdb/5ccc05d276ebno verificadovulncheckvulncheck.com/xdb/e8a1bd301814no verificadovulncheckvulncheck.com/xdb/043a525ec0e4no verificadovulncheckvulncheck.com/xdb/e6753746f8b7no verificadovulncheckvulncheck.com/xdb/05ec071c3006no verificadovulncheckvulncheck.com/xdb/bc3b64de1018no verificadovulncheckvulncheck.com/xdb/d351d4959b91no verificadovulncheckvulncheck.com/xdb/45955df3e0dfno verificadovulncheckvulncheck.com/xdb/c33ca6ed39f6no verificadovulncheckvulncheck.com/xdb/4fcef0954175no verificadovulncheckvulncheck.com/xdb/e4c6e9cbdaefno verificadovulncheckvulncheck.com/xdb/7522628c4302no verificadovulncheckvulncheck.com/xdb/554b62cc1b8cno verificadovulncheckvulncheck.com/xdb/2210c76b12f5no verificadovulncheckvulncheck.com/xdb/eb2e3ecc6d40no verificadovulncheckvulncheck.com/xdb/96a2ba3662e2no verificadovulncheckvulncheck.com/xdb/9fd61fea3bcdno verificadovulncheckvulncheck.com/xdb/a0e1c1067de0no verificadovulncheckvulncheck.com/xdb/cb289c9b68c0no verificadovulncheckvulncheck.com/xdb/ce466865c2f6no verificadovulncheckvulncheck.com/xdb/7d4f2880c446no verificadovulncheckvulncheck.com/xdb/b5de15491c97no verificadovulncheckvulncheck.com/xdb/13105a603082no verificadovulncheckvulncheck.com/xdb/8cf7bc735c45no verificadovulncheckvulncheck.com/xdb/0dad9517c791no verificadovulncheckvulncheck.com/xdb/fef258e57e22no verificadovulncheckvulncheck.com/xdb/5c65e9efe401no verificadovulncheckvulncheck.com/xdb/b46b379891c7no verificadovulncheckvulncheck.com/xdb/a5535be52699no verificadovulncheckvulncheck.com/xdb/bdd754529703no verificadovulncheckvulncheck.com/xdb/b515a040a7c5no verificadovulncheckvulncheck.com/xdb/fdd1700a737ano verificadovulncheckvulncheck.com/xdb/bcca8ea35b8fno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Joomla! CMS
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-26030—[20210401] - Core - Escape xss in logo parameter error pagesEPSS 82.8%CVE-2021-23124—[20210102] - Core - XSS in mod_breadcrumbs aria-label attributeEPSS 79.0%CVE-2024-21726MEDIUM[20240205] - Core - Inadequate content filtering within the filter codeEPSS 48.8%CVE-2020-35613—[20201104] - Core - SQL injection in com_users list viewEPSS 28.9%CVE-2024-21725MEDIUM[20240204] - Core - XSS in mail address outputsEPSS 26.8%CVE-2026-35223HIGHJoomla! Core - [20260508] - Improper access check in com_config webservice endpointsEPSS 12.8%