CVE-2021-23127: [20210301] - Core - Insecure randomness within 2FA secret generation
Published Mar 4, 2021
·Updated
An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes.
Affected Software
1 affected component
Joomla Joomla\!>=3.2.0<3.9.25
Event History
Mar 4, 2021
CVE Published
via MITRE·05:37 PM
Data Sourced
via MITRE·05:37 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this Joomla issue?
The vulnerability ID for this Joomla issue is CVE-2021-23127.
2
What is the severity rating of CVE-2021-23127?
CVE-2021-23127 has a severity rating of 9.1 (critical).
3
What is the affected software version range for CVE-2021-23127?
CVE-2021-23127 affects Joomla versions 3.2.0 through 3.9.24.
4
What is the description of CVE-2021-23127?
CVE-2021-23127 is a vulnerability in Joomla where an insufficient length is used for the 2FA secret according to RFC 4226, with 10 bytes instead of 20 bytes.
5
How can the vulnerability in CVE-2021-23127 be fixed?
To fix the vulnerability in CVE-2021-23127, users should update to Joomla version 3.9.25 or later, which addresses the issue.