CVE-2023-54357: Joomla com_booking 2.4.9 Information Disclosure via Account Enumeration
Joomla combooking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate user accounts by exploiting the getUserData function in the customer controller. Attackers can send GET requests to index.php with option=combooking, controller=customer, task=getUserData, and an id parameter to retrieve user names, usernames, and email addresses through brute force enumeration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
joomla/com_bookingfrom your environment.Uninstall or remove the com_booking component if it is not required to eliminate the vulnerable endpoint (index.php?option=com_booking&controller=customer&task=getUserData).
- Configuration
Disable the getUserData task in the customer controller or change its access control so it requires authentication, preventing unauthenticated GET requests to index.php?option=com_booking&controller=customer&task=getUserData.
Joomla com_booking (customer controller) task=getUserData = disabled or require authentication - Compensating control
Deploy a WAF or firewall rule to block or rate-limit HTTP GET requests matching index.php with parameters option=com_booking, controller=customer, task=getUserData and an id parameter; restrict access to this endpoint to trusted IPs if possible.
- Operational
Review web server and application logs for GET requests to index.php with option=com_booking, controller=customer, task=getUserData and id parameters; investigate and respond to any suspected account enumeration activity.
Event History
Frequently Asked Questions
What is the severity of CVE-2023-54357?
CVE-2023-54357 has a high severity rating of 7.5.
How does CVE-2023-54357 impact Joomla com_booking users?
CVE-2023-54357 allows unauthenticated attackers to enumerate user accounts, potentially exposing sensitive user information.
What versions of Joomla are affected by CVE-2023-54357?
CVE-2023-54357 specifically affects Joomla com_booking version 2.4.9.
How can I mitigate the risk from CVE-2023-54357?
To mitigate CVE-2023-54357, update the Joomla com_booking component to the latest version or disable the affected component.
Is authentication required to exploit CVE-2023-54357?
No, CVE-2023-54357 can be exploited by unauthenticated attackers, meaning no login credentials are needed.