by Kastro
Paper/Archive/CVE-2021-23127

CVE-2021-23127

Joomla! Project Joomla! CMS — [20210301] - Core - Insecure randomness within 2FA secret generation

EPSS 1%CVSS 9.1
critical.is priorityof 100
42
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 72.1.721 × 2014.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes.

Affected

ProductAffectedFixed inSource
Joomla! CMS3.2.0-3.9.24–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

advisorydeveloper.joomla.org/security-centre/841-20210301-core-insecure-randomness-within-2fa-secret-generation.html