GitHub Advisoryadvisory · Packagist
GHSA-rc8q-45v8-x6xc Path Disclosure within joomla/filesystem class
MEDIUM
Official page ↗
- Aliases
- CVE-2022-23794
- Ecosystem
- Packagist
- Packages
- joomla/filesystem
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-209
- Reviewed
- 2024-05-15
Affected packages
• Packagist joomla/filesystem: < 1.6.2 → fixed in 1.6.2
• Packagist joomla/filesystem: >= 2.0.0, < 2.0.1 → fixed in 2.0.1
Description
An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Uploading a file name of an excess length causes the error. This error brings up the screen with the path of the source code of the web application.
Related
Alias · CVE (1)
- CVE-2022-23794 An issue was discovered in Joomla! vulnerability
Weakness · CWE (1)
- CWE-209 Generation of Error Message Containing Sensitive Information weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-23794 advisory
- https://developer.joomla.org/security-centre/871-20220302-core-path-disclosure-within-filesystem-error-messages.html web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/joomla/filesystem/CVE-2022-23794.yaml web
- https://github.com/joomla-framework/filesystem package