CVE-2023-23752
Joomla! Improper Access Control Vulnerability
Description
CVE-2023-23752 is a MEDIUM severity improper access control vulnerability in Joomla! versions 4.0.0 through 4.2.7, carrying a CVSS 3.1 score of 5.3. The flaw, classified under CWE-284 (Improper Access Control), allows unauthenticated remote attackers to access restricted webservice API endpoints without proper authorization. By exploiting this vulnerability, attackers can retrieve sensitive configuration information — including database credentials — from the Joomla! installation without requiring any login. Despite the moderate CVSS score, this vulnerability has an EPSS percentile of 1.0 (100th percentile), reflecting that it is actively exploited in real-world attacks and has been included in CISA’s Known Exploited Vulnerabilities catalog with a remediation deadline of January 29, 2024.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| joomla | joomla\! | >= 4.0.0, < 4.2.8 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
Weakness Type
CWE-284: Improper Access Control
CVE-2023-23752 is rooted in CWE-284 — Improper Access Control. The Joomla! content management system failed to enforce proper authorization checks on its webservice API endpoints. Certain API routes that should require authentication or privileged access were reachable by unauthenticated users, exposing data that should only be available to administrators.
Improper access control at the API layer is a common and high-impact weakness in content management systems. When CMS webservice APIs leak database configuration, the impact extends far beyond information disclosure: an attacker who obtains database credentials can pivot to the underlying database server, extract all site content and user credentials, and potentially gain further access to the hosting environment. This makes even a seemingly moderate CVSS-scored vulnerability highly actionable in practice.
Impact Analysis
CVE-2023-23752 is rated MEDIUM with a CVSS 3.1 score of 5.3, with limited but practically significant impact.
Confidentiality (Low): The vulnerability exposes sensitive configuration data through unauthorized webservice API access. In practice, the most critical data exposed includes database connection details such as the database server hostname, database name, username, and password. These credentials can then be used to directly access the Joomla! database, exposing all user data, hashed passwords, session tokens, site content, and configuration.
Integrity (None): The vulnerability itself does not allow direct data modification. However, database credentials obtained via this flaw can be used in secondary attacks to modify database content, create rogue administrator accounts, or inject malicious content into the CMS.
Availability (None): CVE-2023-23752 does not directly cause service disruption. However, credentials obtained through this vulnerability can enable destructive secondary attacks.
Despite the moderate CVSS score, the practical impact is substantially higher. The EPSS score of 0.945 at the 100th percentile reflects that this vulnerability is exploited at an extremely high rate, as database credential exposure frequently leads to full site compromise in follow-on attacks.
Exploit Maturity
CVE-2023-23752 has an extremely high exploit maturity despite its moderate CVSS score. The EPSS score of 0.945 places this vulnerability at the 100th percentile — the highest possible ranking — indicating it is among the most actively exploited vulnerabilities tracked.
Active exploitation confirmed: CISA added this CVE to the Known Exploited Vulnerabilities catalog, confirming real-world exploitation. The vulnerability has been used in automated scanning campaigns targeting Joomla! installations globally.
Simple exploitation: The attack requires no authentication, no user interaction, and has low attack complexity. This makes it trivially automatable for mass exploitation. Attackers can scan for and exploit vulnerable Joomla! installations with minimal effort using widely available tools.
High-value data extraction: The primary target of exploitation is database credentials exposed through the webservice endpoints. Once extracted, these credentials enable attackers to access the database directly, download all content and user data, crack password hashes, and use compromised credentials for further attacks.
Widespread Joomla! deployments: Joomla! is one of the most widely deployed CMS platforms globally, making the attack surface for this vulnerability very large.
Remediation
- Upgrade to Joomla! 4.2.8 or later. Joomla! addressed CVE-2023-23752 in version 4.2.8 released in February 2023. Upgrade immediately to a fixed version using the official Joomla! security advisory.
- Rotate database credentials immediately. If you are running a vulnerable Joomla! version and cannot rule out exploitation, rotate database credentials as a precautionary measure. Update the Joomla! configuration.php file and any other applications using the same database credentials.
- Review access logs for exploitation signs. Search web server access logs for requests to Joomla! webservice API endpoints (paths containing /api/index.php/v1/ or similar) from unauthenticated sources. Look for anomalous data retrieval patterns that may indicate credential theft.
- Restrict webservice API access. Where the Joomla! API is not required for site functionality, consider disabling the webservice API or restricting access to it at the web server or firewall level.
- Audit for follow-on compromise. If exploitation is suspected, audit the Joomla! database for unauthorized administrator accounts, modified content, or injected malicious code in templates or plugins.
- Keep Joomla! and all extensions updated. Establish a regular patching cadence for the CMS and all installed extensions to reduce exposure to future vulnerabilities.
Technical Details
CVE-2023-23752 affects Joomla! versions 4.0.0 through 4.2.7 and targets the Joomla! webservice API layer introduced in Joomla! 4.x. The webservice API exposes RESTful endpoints for programmatic interaction with the CMS.
Vulnerability mechanism: Certain webservice API endpoints in the affected Joomla! versions did not correctly enforce access controls. Specifically, the API endpoints that expose system configuration information — including database connection parameters — were accessible without valid authentication credentials. The access check logic was improperly implemented (CWE-284), allowing any remote user to issue HTTP GET requests to these endpoints and retrieve sensitive configuration data.
Exposed data: The primary data exposed through this vulnerability includes the Joomla! database configuration: database host, database name, database username, and database password as stored in the Joomla! configuration. This data is sufficient to establish a direct connection to the backend database from an external host if database ports are accessible.
Attack vector: With Network attack vector, Low complexity, no privileges required, and no user interaction (AV:N/AC:L/PR:N/UI:N), the vulnerability is trivially exploitable at scale. Automated tools and vulnerability scanners can identify and exploit vulnerable Joomla! instances with minimal effort.
Secondary exploitation path: Database credentials obtained from this vulnerability can be used to log in directly to the database server, extract all tables, retrieve user password hashes, and potentially create new administrator accounts within the Joomla! application.
Frequently Asked Questions
What is CVE-2023-23752?
CVE-2023-23752 is an improper access control vulnerability (CWE-284) in Joomla! 4.0.0 through 4.2.7. It allows unauthenticated remote attackers to access restricted webservice API endpoints, potentially exposing sensitive configuration information including database credentials. Despite a moderate CVSS score, it is actively exploited in the wild.
Which products are affected by CVE-2023-23752?
Joomla! versions 4.0.0 through 4.2.7 are affected. The vulnerability was fixed in Joomla! 4.2.8, released in February 2023. Organizations running any Joomla! 4.x installation prior to version 4.2.8 should treat their deployments as vulnerable and apply the update without delay.
How do I fix CVE-2023-23752?
Upgrade to Joomla! 4.2.8 or later, which contains the fix for this vulnerability. Additionally, rotate database credentials as a precaution if your Joomla! installation may have been exposed. Review web server access logs for signs of unauthorized API access, and audit the database for signs of follow-on exploitation such as unauthorized admin accounts.
How severe is CVE-2023-23752?
CVE-2023-23752 has a CVSS 3.1 score of 5.3 (MEDIUM), but its practical severity is much higher. The EPSS score of 0.945 places it at the 100th percentile, meaning it is one of the most actively exploited vulnerabilities tracked. CISA confirmed active exploitation and set a federal remediation deadline of January 29, 2024. The exposure of database credentials enables further high-impact attacks on affected Joomla! installations.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.