← voltar
CVE-2023-23752mediumsob ataqueCWE-284

[20230201] - Core - Improper access check in webservice endpoints

100Vexday Risk Score

Corrija agora. Ela está sob exploração confirmada pelo CISA e tem exploit funcional público.

ssvc Actcvss 5.3epss 100%
da publicação à arma2 dias
Publicada no NVD16 de fev.
1ª PoC+2d
metasploit1 de fev.
CISA KEV+326d
probabilidade de exploração
100%top 1% das CVEs
exploração observada
simCISA + VulnCheck
106 exploit(s) público(s)
Ação exigida pela CISAprazo federal: 2024-01-29

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Pesquisado e redigido com IA a partir do advisory do fornecedor e de análises públicas, com as fontes acima. Confira sempre a versão corrigida no advisory oficial antes de agir.
An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
Joomla! Project · Joomla! CMS
PoCs públicas encontradas — 106✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/51334githubgithub.com/Acceis/exploit-CVE-2023-23752★ 94githubgithub.com/Ap0dexMe0/CVE-2023-23752★ 34githubgithub.com/z3n70/CVE-2023-23752★ 17githubgithub.com/K3ysTr0K3R/CVE-2023-23752-EXPLOIT★ 16githubgithub.com/keyuan15/CVE-2023-23752★ 12githubgithub.com/gibran-abdillah/CVE-2023-23752★ 7githubgithub.com/adhikara13/CVE-2023-23752★ 7githubgithub.com/Youns92/Joomla-v4.2.8---CVE-2023-23752★ 6githubgithub.com/0xNahim/CVE-2023-23752★ 5githubgithub.com/Fernando-olv/Joomla-CVE-2023-23752★ 4githubgithub.com/karthikuj/CVE-2023-23752-Docker★ 4githubgithub.com/Sweelg/CVE-2023-23752★ 4githubgithub.com/ifacker/CVE-2023-23752-Joomla★ 3githubgithub.com/Saboor-Hakimi/CVE-2023-23752★ 3githubgithub.com/Vulnmachines/joomla_CVE-2023-23752★ 3githubgithub.com/yusinomy/CVE-2023-23752★ 2githubgithub.com/blacks1ph0n/CVE-2023-23752★ 2githubgithub.com/ibaiw/joomla_CVE-2023-23752★ 2githubgithub.com/0xWhoami35/CVE-2023-23752★ 2githubgithub.com/GhostToKnow/CVE-2023-23752★ 2githubgithub.com/r3dston3/CVE-2023-23752★ 1githubgithub.com/AkbarWiraN/Joomla-Scanner★ 1githubgithub.com/rvzsec/joombrute★ 1githubgithub.com/h3x0v3rl0rd/CVE-2023-23752★ 1githubgithub.com/wangking1/CVE-2023-23752-poc★ 1githubgithub.com/AlissonFaoli/CVE-2023-23752★ 1githubgithub.com/Pushkarup/CVE-2023-23752★ 1githubgithub.com/JohnDoeAnonITA/CVE-2023-23752★ 1githubgithub.com/shellvik/CVE-2023-23752★ 0githubgithub.com/mariovata/CVE-2023-23752-Python★ 0githubgithub.com/0xx01/CVE-2023-23752★ 0githubgithub.com/Aureum01/CVE-2023-23752★ 0githubgithub.com/Marwan651/Joomla-CMS-Full-Lifecycle-Pentest★ 0githubgithub.com/Sharma01672/traveller-htb★ 0githubgithub.com/BardLaudian/CVE-2023-23752★ 0githubgithub.com/Rival420/CVE-2023-23752★ 0githubgithub.com/adriyansyah-mf/CVE-2023-23752★ 0githubgithub.com/Jenderal92/Joomla-CVE-2023-23752★ 0githubgithub.com/JeneralMotors/CVE-2023-23752★ 0githubgithub.com/Ge-Per/Scanner-CVE-2023-23752★ 0githubgithub.com/gunzf0x/CVE-2023-23752★ 0githubgithub.com/sw0rd1ight/CVE-2023-23752★ 0githubgithub.com/MrP4nda1337/CVE-2023-23752★ 0githubgithub.com/yTxZx/CVE-2023-23752★ 0githubgithub.com/Ly0kha/Joomla-CVE-2023-23752-Exploit-Script★ 0githubgithub.com/svaltheim/CVE-2023-23752★ 0githubgithub.com/hadrian3689/CVE-2023-23752_Joomla★ 0githubgithub.com/C1ph3rX13/CVE-2023-23752★ 0vulncheckvulncheck.com/xdb/fdd1700a737anão verificadovulncheckvulncheck.com/xdb/bcca8ea35b8fnão verificadovulncheckvulncheck.com/xdb/ddf2c5d4308dnão verificadovulncheckvulncheck.com/xdb/08d79fdd2c20não verificadovulncheckvulncheck.com/xdb/d11c0b94b56fnão verificadovulncheckvulncheck.com/xdb/a1a80da3e715não verificadovulncheckvulncheck.com/xdb/00f73b1a9db7não verificadovulncheckvulncheck.com/xdb/4922313e9153não verificadovulncheckvulncheck.com/xdb/e75f675ad853não verificadovulncheckvulncheck.com/xdb/8a58bbcc46dfnão verificadovulncheckvulncheck.com/xdb/7b3bb7626edenão verificadovulncheckvulncheck.com/xdb/73bb74556ea0não verificadovulncheckvulncheck.com/xdb/7abe8dabe0ecnão verificadovulncheckvulncheck.com/xdb/bb793678a4c1não verificadovulncheckvulncheck.com/xdb/ae3ff3c0e355não verificadovulncheckvulncheck.com/xdb/14f43e8a9127não verificadovulncheckvulncheck.com/xdb/4567f3a2525dnão verificadovulncheckvulncheck.com/xdb/992ddc9eaf34não verificadovulncheckvulncheck.com/xdb/a21e9dba9052não verificadovulncheckvulncheck.com/xdb/761b2b5d20c0não verificadovulncheckvulncheck.com/xdb/0c0007f3a9a4não verificadovulncheckvulncheck.com/xdb/318208166f71não verificadovulncheckvulncheck.com/xdb/a5e6c33317aenão verificadovulncheckvulncheck.com/xdb/ae30c8d7f152não verificadovulncheckvulncheck.com/xdb/0688e24d7079não verificadovulncheckvulncheck.com/xdb/d6ec7cba19canão verificadovulncheckvulncheck.com/xdb/5ccc05d276ebnão verificadovulncheckvulncheck.com/xdb/e8a1bd301814não verificadovulncheckvulncheck.com/xdb/043a525ec0e4não verificadovulncheckvulncheck.com/xdb/e6753746f8b7não verificadovulncheckvulncheck.com/xdb/05ec071c3006não verificadovulncheckvulncheck.com/xdb/bc3b64de1018não verificadovulncheckvulncheck.com/xdb/d351d4959b91não verificadovulncheckvulncheck.com/xdb/45955df3e0dfnão verificadovulncheckvulncheck.com/xdb/c33ca6ed39f6não verificadovulncheckvulncheck.com/xdb/4fcef0954175não verificadovulncheckvulncheck.com/xdb/e4c6e9cbdaefnão verificadovulncheckvulncheck.com/xdb/7522628c4302não verificadovulncheckvulncheck.com/xdb/554b62cc1b8cnão verificadovulncheckvulncheck.com/xdb/2210c76b12f5não verificadovulncheckvulncheck.com/xdb/eb2e3ecc6d40não verificadovulncheckvulncheck.com/xdb/96a2ba3662e2não verificadovulncheckvulncheck.com/xdb/9fd61fea3bcdnão verificadovulncheckvulncheck.com/xdb/a0e1c1067de0não verificadovulncheckvulncheck.com/xdb/cb289c9b68c0não verificadovulncheckvulncheck.com/xdb/ce466865c2f6não verificadovulncheckvulncheck.com/xdb/7d4f2880c446não verificadovulncheckvulncheck.com/xdb/b5de15491c97não verificadovulncheckvulncheck.com/xdb/13105a603082não verificadovulncheckvulncheck.com/xdb/8cf7bc735c45não verificadovulncheckvulncheck.com/xdb/0dad9517c791não verificadovulncheckvulncheck.com/xdb/fef258e57e22não verificadovulncheckvulncheck.com/xdb/5c65e9efe401não verificadovulncheckvulncheck.com/xdb/b46b379891c7não verificadovulncheckvulncheck.com/xdb/a5535be52699não verificadovulncheckvulncheck.com/xdb/bdd754529703não verificadovulncheckvulncheck.com/xdb/b515a040a7c5não verificado
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
https://developer.joomla.org/security-centre/894-20230201-core-improper-access-check-in-webservice-endpoints.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-23752