An issue was discovered in Joomla! before 3.9.21. Lack of escaping in mod_latestactions allows XSS attacks.

According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.9.21. It is, therefore, affected by multiple vulnerabilities.

- Lack of escaping in mod_latestactions allows Cross-Site Scripting (XSS) attacks. (CVE-2020-24599)

- Lack of input validation in com_content leads to an open redirect. (CVE-2020-24598)

- Lack of input validation allows com_media root paths outside of the webroot. (CVE-2020-24597)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.9.21. It is, therefore, affected by multiple vulnerabilities.

  - Lack of escaping in mod_latestactions allows XSS attacks. (CVE-2020-24599)

  - Lack of input validation in com_content leads to an open redirect. (CVE-2020-24598)

  - Lack of input validation allows com_media root paths outside of the webroot. (CVE-2020-24597)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
112581	Joomla! 2.5.x < 3.9.21 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
139875	Joomla 2.5.x < 3.9.21 Multiple Vulnerabilities (5821-joomla-3-9-21)	Nessus	CGI abuses	Remote	medium

Detections

Analytics

CVE-2020-24599

medium

Tenable Plugins

medium

medium