CVE-2022-23795: [20220303] - Core - User row are not bound to a authentication mechanism
An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to a specific authentication mechanism which could under very special circumstances allow an account takeover.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-23795?
CVE-2022-23795 is a vulnerability in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0 that allows an account takeover under certain circumstances.
How severe is CVE-2022-23795?
CVE-2022-23795 has a severity rating of 9.8 (Critical).
Which software versions are affected by CVE-2022-23795?
Joomla! versions 2.5.0 through 3.10.6 and 4.0.0 through 4.1.0 are affected by CVE-2022-23795.
How can an attacker exploit CVE-2022-23795?
An attacker can exploit CVE-2022-23795 by taking advantage of the user row not being bound to a specific authentication mechanism.
Is there a fix for CVE-2022-23795?
Yes, Joomla! has released a security update to address CVE-2022-23795. It is recommended to update to the latest version available.