{"id":"CVE-2023-23752","aliases":["BIT-joomla-2023-23752","EUVD-2023-27838","GHSA-jmc9-376w-885v"],"status":"published","title":"[20230201] - Core - Improper access check in webservice endpoints","description":"An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.99809,"percentile":0.99958,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-284"],"published":"2023-02-16T16:25:21Z","modified":"2026-10-24T10:30:31Z","kev":{"date_added":"2024-01-08","due_date":"2024-01-29","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2024-01-08"},{"source":"kev","since":"2024-01-08"}],"exploits":[{"source":"pocgithub","id":"Saboor-Hakimi/CVE-2023-23752","title":"Saboor-Hakimi/CVE-2023-23752","date":"2023-02-18","url":"https://github.com/Saboor-Hakimi/CVE-2023-23752"},{"source":"pocgithub","id":"yusinomy/CVE-2023-23752","title":"yusinomy/CVE-2023-23752","date":"2023-02-18","url":"https://github.com/yusinomy/CVE-2023-23752"},{"source":"pocgithub","id":"Vulnmachines/joomla_CVE-2023-23752","title":"Vulnmachines/joomla_CVE-2023-23752","date":"2023-02-20","url":"https://github.com/Vulnmachines/joomla_CVE-2023-23752"},{"source":"pocgithub","id":"sw0rd1ight/CVE-2023-23752","title":"sw0rd1ight/CVE-2023-23752","date":"2023-02-21","url":"https://github.com/sw0rd1ight/CVE-2023-23752"},{"source":"pocgithub","id":"ibaiw/joomla_CVE-2023-23752","title":"ibaiw/joomla_CVE-2023-23752","date":"2023-02-23","url":"https://github.com/ibaiw/joomla_CVE-2023-23752"},{"source":"pocgithub","id":"ifacker/CVE-2023-23752-Joomla","title":"ifacker/CVE-2023-23752-Joomla","date":"2023-02-23","url":"https://github.com/ifacker/CVE-2023-23752-Joomla"},{"source":"pocgithub","id":"wangking1/CVE-2023-23752-poc","title":"wangking1/CVE-2023-23752-poc","date":"2023-02-23","url":"https://github.com/wangking1/CVE-2023-23752-poc"},{"source":"pocgithub","id":"z3n70/CVE-2023-23752","title":"z3n70/CVE-2023-23752","date":"2023-02-24","url":"https://github.com/z3n70/CVE-2023-23752"},{"source":"pocgithub","id":"keyuan15/CVE-2023-23752","title":"keyuan15/CVE-2023-23752","date":"2023-03-01","url":"https://github.com/keyuan15/CVE-2023-23752"},{"source":"pocgithub","id":"adriyansyah-mf/CVE-2023-23752","title":"adriyansyah-mf/CVE-2023-23752","date":"2023-03-07","url":"https://github.com/adriyansyah-mf/CVE-2023-23752"},{"source":"pocgithub","id":"GhostToKnow/CVE-2023-23752","title":"GhostToKnow/CVE-2023-23752","date":"2023-03-09","url":"https://github.com/GhostToKnow/CVE-2023-23752"},{"source":"pocgithub","id":"gibran-abdillah/CVE-2023-23752","title":"gibran-abdillah/CVE-2023-23752","date":"2023-03-09","url":"https://github.com/gibran-abdillah/CVE-2023-23752"},{"source":"pocgithub","id":"Jenderal92/Joomla-CVE-2023-23752","title":"Jenderal92/Joomla-CVE-2023-23752","date":"2023-03-11","url":"https://github.com/Jenderal92/Joomla-CVE-2023-23752"},{"source":"pocgithub","id":"Acceis/exploit-CVE-2023-23752","title":"Acceis/exploit-CVE-2023-23752","date":"2023-03-24","url":"https://github.com/Acceis/exploit-CVE-2023-23752"},{"source":"pocgithub","id":"karthikuj/CVE-2023-23752-Docker","title":"karthikuj/CVE-2023-23752-Docker","date":"2023-03-25","url":"https://github.com/karthikuj/CVE-2023-23752-Docker"},{"source":"pocgithub","id":"0xNahim/CVE-2023-23752","title":"0xNahim/CVE-2023-23752","date":"2023-03-26","url":"https://github.com/0xNahim/CVE-2023-23752"},{"source":"pocgithub","id":"adhikara13/CVE-2023-23752","title":"adhikara13/CVE-2023-23752","date":"2023-04-04","url":"https://github.com/adhikara13/CVE-2023-23752"},{"source":"pocgithub","id":"AkbarWiraN/Joomla-Scanner","title":"AkbarWiraN/Joomla-Scanner","date":"2023-04-06","url":"https://github.com/AkbarWiraN/Joomla-Scanner"},{"source":"exploitdb","id":"EDB-51334","title":"Joomla! v4.2.8 - Unauthenticated information disclosure","type":"webapps","platform":"php","date":"2023-04-08","verified":true,"url":"https://www.exploit-db.com/exploits/51334"},{"source":"pocgithub","id":"Ap0dexMe0/CVE-2023-23752","title":"Ap0dexMe0/CVE-2023-23752","date":"2023-04-09","url":"https://github.com/Ap0dexMe0/CVE-2023-23752"},{"source":"pocgithub","id":"Sweelg/CVE-2023-23752","title":"Sweelg/CVE-2023-23752","date":"2023-06-16","url":"https://github.com/Sweelg/CVE-2023-23752"},{"source":"pocgithub","id":"MrP4nda1337/CVE-2023-23752","title":"MrP4nda1337/CVE-2023-23752","date":"2023-07-26","url":"https://github.com/MrP4nda1337/CVE-2023-23752"},{"source":"pocgithub","id":"AlissonFaoli/CVE-2023-23752","title":"AlissonFaoli/CVE-2023-23752","date":"2023-10-20","url":"https://github.com/AlissonFaoli/CVE-2023-23752"},{"source":"pocgithub","id":"yTxZx/CVE-2023-23752","title":"yTxZx/CVE-2023-23752","date":"2023-10-20","url":"https://github.com/yTxZx/CVE-2023-23752"},{"source":"pocgithub","id":"Pushkarup/CVE-2023-23752","title":"Pushkarup/CVE-2023-23752","date":"2023-10-25","url":"https://github.com/Pushkarup/CVE-2023-23752"},{"source":"pocgithub","id":"blacks1ph0n/CVE-2023-23752","title":"blacks1ph0n/CVE-2023-23752","date":"2023-10-30","url":"https://github.com/blacks1ph0n/CVE-2023-23752"},{"source":"metasploit","id":"auxiliary/scanner/http/joomla_api_improper_access_checks","title":"Joomla API Improper Access Checks","type":"auxiliary","date":"2023-02-01","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/http/joomla_api_improper_access_checks"},{"source":"nuclei","id":"CVE-2023-23752","title":"Joomla! Webservice - Password Disclosure","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-23752.yaml"}],"exploits_more":24,"fixes":[{"ecosystem":"Bitnami","package":"joomla","fixed_in":["4.2.8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"joomla","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.2.8"}]}]}],"products":[{"vendor":"joomla","product":"joomla\\!"},{"vendor":"joomla!","product":"joomla!"},{"vendor":"joomla! project","product":"joomla! cms"}],"references":[{"url":"https://developer.joomla.org/security-centre/894-20230201-core-improper-access-check-in-webservice-endpoints.html","tags":["vendor-advisory","x_transferred","Vendor Advisory","advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-23752","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23752","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jmc9-376w-885v"}],"sources":{"cve":[{"id":"CVE-2023-23752","title":"[20230201] - Core - Improper access check in webservice endpoints","description":"An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.","status":"published","published":"2023-02-16T16:25:21.003Z","modified":"2026-02-26T05:05:03.342Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:35:20.812737Z"}],"euvd":[{"id":"EUVD-2023-27838","description":"An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.","status":"published","published":"2023-02-16T16:25:21Z","modified":"2026-02-26T05:05:03Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"exploited_since":"2024-01-08","updated_at":"2026-11-02T19:48:28.012266Z"}],"ghsa":[{"id":"GHSA-jmc9-376w-885v","title":"An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows...","description":"An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.","status":"published","published":"2023-02-16T18:30:27Z","modified":"2025-10-22T00:32:43Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:04:06.493434Z"}],"kev":[{"id":"CVE-2023-23752","title":"Joomla! Improper Access Control Vulnerability","description":"Joomla! contains an improper access control vulnerability that allows unauthorized access to webservice endpoints.","cwes":["CWE-284"],"kev":{"date_added":"2024-01-08","due_date":"2024-01-29","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2023-23752","description":"An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.","status":"published","published":"2023-02-16T17:15:10.603Z","modified":"2026-06-17T05:37:50.963Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:07:46.811196Z"}],"osv":[{"id":"CVE-2023-23752","description":"An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.","status":"published","published":"2023-02-16T17:15:10.603Z","modified":"2026-10-24T10:30:31.576674174Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:30.709518Z"},{"id":"BIT-joomla-2023-23752","title":"[20230201] - Core - Improper access check in webservice endpoints","description":"An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.","status":"published","published":"2025-04-03T14:15:54.999Z","modified":"2026-09-08T08:48:02.596499153Z","updated_at":"2026-11-02T15:28:31.782692Z"}]}}