Inadequate content filtering leads to XSS vulnerabilities in various components.

While user interaction is required to exploit this flaw, using spray-and-pray attacks could lead to exploitation. We're monitoring for additional information.

According to its self-reported version, the instance of Joomla! running on the remote web server is 1.5.x prior to 4.4.3 or 5.x prior to 5.0.3. It is, therefore, affected by multiple vulnerabilities.

 - An insufficient session expiration in MFA management views. (CVE-2024-21722)

 - An open redirect in installation application. (CVE-2024-21723)

 - A Cross-Site Scripting (XSS) in media selection fields. (CVE-2024-21724)

 - A Cross-Site Scripting (XSS) in mail address outputs. (CVE-2024-21725)

 - An inadequate content filtering within the filter code. (CVE-2024-21726)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of Joomla! running on the remote web server is 1.5.x prior to 3.10.15, 4.0.x prior to 4.4.3, or 5.0.x prior to 5.0.3. It is, therefore, affected by multiple vulnerabilities.

  - The MFA management features did not properly terminate existing user sessions when a user's MFA methods     have been modified. (CVE-2024-21722)

  - Inadequate parsing of URLs could result into an open redirect. (CVE-2024-21723)

  - Inadequate input validation for media selection fields lead to XSS vulnerabilities in various extensions.
    (CVE-2024-21724)

  - Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components. (CVE-2024-21725)

  - Inadequate content filtering leads to XSS vulnerabilities in various components. (CVE-2024-21726)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
114218	Joomla! 1.5.x < 4.4.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
114217	Joomla! 5.x < 5.0.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
190786	Joomla 1.5.x < 3.10.15 / 4.0.x < 4.4.3 / 5.0.x < 5.0.3 Multiple Vulnerabilities (5904-joomla-5-0-3-and-4-4-3-security-and-bug-fix-release)	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2024-21726

medium

Tenable Plugins

medium

medium

medium