CVE-2022-23794: [20220302] - Core - Path Disclosure within filesystem error messages
First published: Tue Mar 29 2022(Updated: )
An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Uploading a file name of an excess length causes the error. This error brings up the screen with the path of the source code of the web application.
Credit: security@joomla.org security@joomla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/joomla/filesystem | <1.6.2>=2.0.0<2.0.1 | |
| Joomla Joomla\! | >=3.0.0<=3.10.6 | |
| Joomla Joomla\! | >=4.0.0<=4.1.0 | |
| composer/joomla/filesystem | >=2.0.0<2.0.1 | 2.0.1 |
| composer/joomla/filesystem | <1.6.2 | 1.6.2 |
| >=3.0.0<=3.10.6 | ||
| >=4.0.0<=4.1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://developer.joomla.org/security-centre/871-20220302-core-path-disclosure-within-filesystem-error-messages.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-23794
- https://github.com/FriendsOfPHP/security-advisories/blob/master/joomla/filesystem/CVE-2022-23794.yaml
- https://github.com/advisories/GHSA-rc8q-45v8-x6xc (Advisory)
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-23794.
What is the severity of CVE-2022-23794?
The severity of CVE-2022-23794 is medium, with a severity value of 5.3.
What is the description of CVE-2022-23794?
CVE-2022-23794 is a vulnerability in Joomla! versions 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0 that allows path disclosure, revealing the source code path of the web application.
Which software versions are affected by CVE-2022-23794?
Joomla! versions 3.0.0 through 3.10.6 and 4.0.0 through 4.1.0 are affected by CVE-2022-23794.
How can I fix CVE-2022-23794?
To fix CVE-2022-23794, you should update Joomla! to version 3.10.7 or 4.1.1 or later.
- collector/friends-of-php
- collector/nvd-index
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-rc8q-45v8-x6xc
- alias/CVE-2022-23794
- agent/software-canonical-lookup
- agent/severity
- agent/references
- agent/weakness
- agent/description
- agent/author
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/event
- agent/tags
- agent/first-publish-date
- package-manager/composer
- vendor/joomla
- canonical/joomla joomla\!
- version/joomla joomla\!/3.0.0
- version/joomla joomla\!/3.10.6
- version/joomla joomla\!/4.0.0
- version/joomla joomla\!/4.1.0