An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to a specific authentication mechanism which could under very special circumstances allow an account takeover.

According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.10.7 or 4.x prior to 4.1.1. It is, therefore, affected by multiple vulnerabilities.

- Extracting an specifilcy crafted tar package could write files outside of the intended path. (CVE-2022-23793)

- Uploading a file name of an excess length causes the error. This error brings up the screen with the path of the source code of the web application. (CVE-2022-23794)

- A user row was not bound to a specific authentication mechanism which could under very special circumstances allow an account takeover. (CVE-2022-23795)

- Lack of input validation could allow an XSS attack using com_fields. (CVE-2022-23796)

- Inadequate filtering on the selected Ids on an request could resulted into an possible SQL injection. (CVE-2022-23797)

- Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not. (CVE-2022-23798)

- Under specific circumstances, JInput pollutes method-specific input bags with $_REQUEST data. (CVE-2022-23799)

- Inadequate content filtering leads to XSS vulnerabilities in various components. (CVE-2022-23800)

- Possible XSS attack vector through SVG embedding in com_media. (CVE-2022-23801)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
113216	Joomla! 2.5.x < 3.10.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
113215	Joomla! 4.x < 4.1.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical

Detections

Analytics

CVE-2022-23795

critical

Tenable Plugins

critical

critical