{"id":"CVE-2022-27912","aliases":["BIT-joomla-2022-27912","EUVD-2022-32400","GHSA-hjfj-25p5-2p2v"],"status":"published","title":"[20221001] - Core - Debug Mode leaks full request payloads including passwords","description":"An issue was discovered in Joomla! 4.0.0 through 4.2.3. Sites with publicly enabled debug mode exposed data of previous requests.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00616,"percentile":0.49844,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200","CWE-668"],"published":"2022-10-25T19:00:14Z","modified":"2026-10-24T10:31:03Z","affected":[{"source":"osv","ecosystem":"Bitnami","package":"joomla","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"last_affected":"4.2.3"}]}]}],"products":[{"vendor":"joomla","product":"joomla\\!"},{"vendor":"joomla! project","product":"joomla! cms"}],"references":[{"url":"https://developer.joomla.org/security-centre/885-20221001-core-disclosure-of-critical-information-in-debug-mode.html","tags":["vendor-advisory","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-27912","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hjfj-25p5-2p2v"}],"sources":{"cve":[{"id":"CVE-2022-27912","title":"[20221001] - Core - Debug Mode leaks full request payloads including passwords","description":"An issue was discovered in Joomla! 4.0.0 through 4.2.3. Sites with publicly enabled debug mode exposed data of previous requests.","status":"published","published":"2022-10-25T19:00:14.614Z","modified":"2024-09-16T22:31:14.253Z","updated_at":"2026-11-02T14:34:34.250357Z"}],"euvd":[{"id":"EUVD-2022-32400","description":"An issue was discovered in Joomla! 4.0.0 through 4.2.3. Sites with publicly enabled debug mode exposed data of previous requests.","status":"published","published":"2022-10-25T19:00:14Z","modified":"2024-09-16T22:31:14Z","updated_at":"2026-11-03T00:55:02.001238Z"}],"ghsa":[{"id":"GHSA-hjfj-25p5-2p2v","title":"An issue was discovered in Joomla! 4.0.0 through 4.2.3. Sites with publicly enabled debug mode...","description":"An issue was discovered in Joomla! 4.0.0 through 4.2.3. Sites with publicly enabled debug mode exposed data of previous requests.","status":"published","published":"2022-10-26T12:00:39Z","modified":"2023-12-10T05:05:03Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-668"],"updated_at":"2026-11-02T14:55:10.314842Z"}],"nvd":[{"id":"CVE-2022-27912","description":"An issue was discovered in Joomla! 4.0.0 through 4.2.3. Sites with publicly enabled debug mode exposed data of previous requests.","status":"published","published":"2022-10-25T19:15:09.85Z","modified":"2026-06-17T04:37:44.093Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:07:31.127985Z"}],"osv":[{"id":"CVE-2022-27912","description":"An issue was discovered in Joomla! 4.0.0 through 4.2.3. Sites with publicly enabled debug mode exposed data of previous requests.","status":"published","published":"2022-10-25T19:15:09.85Z","modified":"2026-10-24T10:31:03.098755863Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:24.758293Z"},{"id":"BIT-joomla-2022-27912","title":"[20221001] - Core - Debug Mode leaks full request payloads including passwords","description":"An issue was discovered in Joomla! 4.0.0 through 4.2.3. Sites with publicly enabled debug mode exposed data of previous requests.","status":"published","published":"2025-04-03T14:15:18.09Z","modified":"2026-09-08T08:48:02.76823629Z","updated_at":"2026-11-02T15:28:31.782692Z"}]}}