by Kastro
Paper/Archive/CVE-2021-23128

CVE-2021-23128

Joomla! Project Joomla! CMS — [20210302] - Core - Potential Insecure FOFEncryptRandval

EPSS 1%CVSS 9.1
critical.is priorityof 100
42
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 72.1.721 × 2014.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An issue was discovered in Joomla! 3.2.0 through 3.9.24. The core shipped but unused randval implementation within FOF (FOFEncryptRandval) used an potential insecure implemetation. That has now been replaced with a call to 'random_bytes()' and its backport that is shipped within random_compat.

Affected

ProductAffectedFixed inSource
Joomla! CMS3.2.0-3.9.24–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

advisorydeveloper.joomla.org/security-centre/842-20210302-core-potential-insecure-fofencryptrandval.html