CVE-2023-23752

MediumCVSS 5.3/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-284

Affected software

VendorProductVersions
Joomla! ProjectJoomla! CMS4.0.0-4.2.7
joomlajoomla\!>= 4.0.0, <= 4.2.7

References

Timeline

Published
Feb 16, 2023
Last modified
Jun 17, 2026
Added to CISA KEV
Jan 8, 2024
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-237539.8The 'Visforms Base Package for Joomla 3' extension is vulnerable to SQL Injection as concatenation is used to construct an SQL Query. An attCVE-2023-237546.1An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redirect and XSS issue within the new mfa seCVE-2023-237557.5An issue was discovered in Joomla! 4.2.0 through 4.3.1. The lack of rate limiting allowed brute force attacks against MFA methods.CVE-2023-237566.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in advcomsys.com oneVote component for JoCVE-2023-237579.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.CVE-2023-237589.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.CVE-2023-237597.5There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely. This behavior requiresCVE-2023-23767.2A security vulnerability has been detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The affected element is an unknown function of theCVE-2023-237608.8A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages siCVE-2023-237615.3An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to modify other usersCVE-2023-237625.3An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diCVE-2023-237635.3An authorization/sensitive information disclosure vulnerability was identified in GitHub Enterprise Server that allowed a fork to retain rea
CVE-2023-23752: Medium severity, CVSS 5.3 | Vulnix