VulnerabilityModified

CVE-2021-23128

The core shipped but unused randval implementation within FOF (FOFEncryptRandval) used an potential insecure implemetation.

CRITICAL 9.1EPSS 1.33%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.33%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An issue was discovered in Joomla! 3.2.0 through 3.9.24. The core shipped but unused randval implementation within FOF (FOFEncryptRandval) used an potential insecure implemetation. That has now been replaced with a call to 'random_bytes()' and its backport that is shipped within random_compat.

CVSS 3.1: 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS: 1.33% probability · 70th percentile
CISA KEV: Not listed
Affected: joomla/joomla\!
Source: security@joomla.org

References

https://developer.joomla.org/security-centre/842-20210302-core-potential-insecure-fofencryptrandval.htmlVendor Advisory
https://developer.joomla.org/security-centre/842-20210302-core-potential-insecure-fofencryptrandval.htmlVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.