An improper access check in Joomla 4 web service endpoints let anyone read the site configuration — including database credentials.
Publicly disclosed: 16 February 2023
In February 2023 Joomla fixed an access check error in the web service (API) endpoints of Joomla 4. Without logging in, an attacker could request data that should be private, including the site configuration with database user and password. The score was only “medium”, but attackers quickly used it, and CISA later listed it as exploited.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2023-23752 | Medium, CVSS 5.3 (improper access check, information disclosure) | Joomla 4.0.0 – 4.2.7 | 4.2.8 and later |
The lesson: severity scores do not tell the whole story. If a leaked password works for the database — or is reused elsewhere — a “medium” flaw becomes a full compromise. After updating, change the database password and any reused passwords.
Sources: Joomla security announcement, NVD CVE-2023-23752.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.
