Description Preview
CVE-2020-35611 affects Joomla! versions 2.5.0 through 3.9.22. The vulnerability allows unauthorized disclosure of sensitive information as the global configuration page fails to properly remove secrets from the HTML output, potentially exposing configuration secrets to users with access to this page.
Overview
This vulnerability (CWE-200: Information Exposure) exists in Joomla's global configuration page where sensitive information such as API keys, passwords, or other configuration secrets are not properly masked or removed from the HTML output. When administrators access the global configuration page, these secrets are embedded in the page source, potentially exposing them to anyone who can view the page source or intercept the HTTP response. This could lead to unauthorized access to connected services, data breaches, or further system compromise if these secrets are obtained by malicious actors.
Remediation
- Update Joomla! to version 3.9.23 or later which contains the fix for this vulnerability.
- If immediate update is not possible, restrict access to the administrator area and specifically the global configuration page to only trusted administrators.
- Consider changing any secrets that may have been exposed, including API keys, database credentials, and other sensitive configuration values.
- Implement additional security layers such as IP restrictions for administrative access and two-factor authentication for administrator accounts.
- Regularly audit your Joomla installation for security updates and apply them promptly.
References
- Joomla Security Centre Advisory: https://developer.joomla.org/security-centre/829-20201102-core-disclosure-of-secrets-in-global-configuration-page.html
- Common Weakness Enumeration: CWE-200 (Information Exposure) - https://cwe.mitre.org/data/definitions/200.html
- Joomla Security Release: https://www.joomla.org/announcements/release-news/5813-joomla-3-9-23-release.html
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- ManufacturingManufacturing
- Accommodation & Food ServicesAccommodation & Food Services
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting
- Arts, Entertainment & RecreationArts, Entertainment & Recreation
- ConstructionConstruction
- Educational ServicesEducational Services
- Finance and InsuranceFinance and Insurance
- Health Care & Social AssistanceHealth Care & Social Assistance
- InformationInformation
- Management of Companies & EnterprisesManagement of Companies & Enterprises
- MiningMining
- Other Services (except Public Administration)Other Services (except Public Administration)
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services
- Public AdministrationPublic Administration
- Real Estate Rental & LeasingReal Estate Rental & Leasing
- Retail TradeRetail Trade
- Transportation & WarehousingTransportation & Warehousing
- UtilitiesUtilities
- Wholesale TradeWholesale Trade
