{"id":"CVE-2023-23750","aliases":["BIT-joomla-2023-23750","EUVD-2023-27836","GHSA-xr3c-3fp9-4fcp"],"status":"published","title":"[20230101] - Core - CSRF within post-installation messages","description":"An issue was discovered in Joomla! 4.0.0 through 4.2.6. A missing token check causes a CSRF vulnerability in the handling of post-installation messages.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00236,"percentile":0.14754,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2023-02-01T21:12:36Z","modified":"2026-10-24T10:31:02Z","affected":[{"source":"osv","ecosystem":"Bitnami","package":"joomla","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"last_affected":"4.2.6"}]}]}],"products":[{"vendor":"joomla","product":"joomla\\!"},{"vendor":"joomla! project","product":"joomla! cms"}],"references":[{"url":"https://developer.joomla.org/security-centre/890-20230101-core-csrf-within-post-installation-messages.html","tags":["vendor-advisory","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23750","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xr3c-3fp9-4fcp"}],"sources":{"cve":[{"id":"CVE-2023-23750","title":"[20230101] - Core - CSRF within post-installation messages","description":"An issue was discovered in Joomla! 4.0.0 through 4.2.6. A missing token check causes a CSRF vulnerability in the handling of post-installation messages.","status":"published","published":"2023-02-01T21:12:36.067Z","modified":"2025-03-29T04:35:17.502Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:35:21.232549Z"}],"euvd":[{"id":"EUVD-2023-27836","description":"An issue was discovered in Joomla! 4.0.0 through 4.2.6. A missing token check causes a CSRF vulnerability in the handling of post-installation messages.","status":"published","published":"2023-02-01T21:12:36Z","modified":"2025-03-29T04:35:17Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:52:47.247959Z"}],"ghsa":[{"id":"GHSA-xr3c-3fp9-4fcp","title":"An issue was discovered in Joomla! 4.0.0 through 4.2.6. A missing token check causes a CSRF...","description":"An issue was discovered in Joomla! 4.0.0 through 4.2.6. A missing token check causes a CSRF vulnerability in the handling of post-installation messages.","status":"published","published":"2023-02-02T00:30:15Z","modified":"2023-02-08T21:30:20Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:53:59.604858Z"}],"nvd":[{"id":"CVE-2023-23750","description":"An issue was discovered in Joomla! 4.0.0 through 4.2.6. A missing token check causes a CSRF vulnerability in the handling of post-installation messages.","status":"published","published":"2023-02-01T22:15:09Z","modified":"2026-06-17T05:37:50.623Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:07:46.064662Z"}],"osv":[{"id":"CVE-2023-23750","description":"An issue was discovered in Joomla! 4.0.0 through 4.2.6. A missing token check causes a CSRF vulnerability in the handling of post-installation messages.","status":"published","published":"2023-02-01T22:15:09Z","modified":"2026-10-24T10:31:02.579944145Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:30.709518Z"},{"id":"BIT-joomla-2023-23750","title":"[20230101] - Core - CSRF within post-installation messages","description":"An issue was discovered in Joomla! 4.0.0 through 4.2.6. A missing token check causes a CSRF vulnerability in the handling of post-installation messages.","status":"published","published":"2025-04-03T14:15:38.995Z","modified":"2026-09-08T08:48:02.416892061Z","updated_at":"2026-11-02T15:28:31.782692Z"}]}}