An issue was discovered in Joomla! 3.0.0 through 3.9.24. com_media allowed paths that are not intended for image uploads

According to its self-reported version, the instance of Joomla! running on the remote web server is 1.6.x prior to 3.9.25. It is, therefore, affected by multiple vulnerabilities.

  - An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of the insecure rand() function within     the process of generating the 2FA secret. (CVE-2021-23126)

  - An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA     secret accoring to RFC 4226 of 10 bytes vs 20 bytes. (CVE-2021-23127)

  - An issue was discovered in Joomla! 3.2.0 through 3.9.24. The core shipped but unused randval implementation     within FOF (FOFEncryptRandval) used an potential insecure implemetation. That has now been replaced with a     call to 'random_bytes()' and its backport that is shipped within random_compat. (CVE-2021-23128)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.x prior to 3.9.25. It is, therefore, affected by multiple vulnerabilities.

- Usage of the insecure rand() function within the process of generating the 2FA secret. (CVE-2021-23126)

- Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes. (CVE-2021-23127)

- The core shipped but unused randval implementation within FOF (FOFEncryptRandval) used an potential insecure implemetation. (CVE-2021-23128)

- Missing filtering of messages showed to users that could lead to XSS issues. (CVE-2021-23129)

- Missing filtering of feed fields could lead to XSS issues. (CVE-2021-23130)

- Missing input validation within the template manager. (CVE-2021-23131)

- com_media allowed paths that are not intended for image uploads. (CVE-2021-23132)

- Incorrect ACL checks could allow unauthorized change of the category for an article. (CVE-2021-26027)

- Extracting an specifilcy crafted zip package could write files outside of the intended path. (CVE-2021-26028)

- Inadequate filtering of form contents could allow to overwrite the author field. (CVE-2021-26029)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
147705	Joomla 1.6.x < 3.9.25 Multiple Vulnerabilities (5834-joomla-3-9-25)	Nessus	CGI abuses	Remote	critical
112713	Joomla! 3.x < 3.9.25 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical

Detections

Analytics

CVE-2021-23132

high

Tenable Plugins

critical

critical