Back to KEVs

CVE-2023-23752

[20230201] - Core - Improper access check in webservice endpoints

Basic Information

CVE State: PUBLISHED
Reserved Date: January 17, 2023
Published Date: February 16, 2023
Last Updated: August 04, 2024
Vendor: Joomla! Project
Product: Joomla! CMS
Description: An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.

CVSS Scores

CVSS v3.1

5.3 - MEDIUM

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC Information

Exploitation: active
Automatable: Yes
Technical Impact: partial

Exploit Status

Exploited in the Wild: Yes (added 2024-01-08 00:00:00 UTC) Source
Proof of Concept Available: Yes (added 2023-11-28 16:08:16 UTC) Source

References

https://developer.joomla.org/security-centre/894-20230201-core-improper-access-check-in-webservice-endpoints.html

Known Exploited Vulnerability Information

Source	Added Date
CISA	2024-01-08 00:00:00 UTC

Scanner Integrations

Scanner	URL	Date Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-23752.yaml	2025-04-26 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

mil4ne/CVE-2023-23752-Joomla-v4.2.8

Type: github • Created: 2024-05-05 16:16:03 UTC • Stars: 5

0xWhoami35/CVE-2023-23752

Type: github • Created: 2024-04-11 13:39:44 UTC • Stars: 2

JohnDoeAnonITA/CVE-2023-23752

Type: github • Created: 2024-03-12 10:59:10 UTC • Stars: 3

CVE-2023-23752 Data Extractor

K3ysTr0K3R/CVE-2023-23752-EXPLOIT

Type: github • Created: 2023-12-04 13:05:08 UTC • Stars: 10

A PoC exploit for CVE-2023-23752 - Joomla Improper Access Check in Versions 4.0.0 through 4.2.7

Fernando-olv/Joomla-CVE-2023-23752

Type: github • Created: 2023-12-01 02:25:04 UTC • Stars: 4

This Python implementation serves an educational purpose by demonstrating the exploitation of CVE-2023-23752. The code provides insight into the vulnerability's exploitation.