BIT-joomla-2020-35611

vendorUSosv

[20201102] - Core - Disclosure of secrets in Global Configuration page

view advisory published 2025-04-03Licence: per source

An issue was discovered in Joomla! 2.5.0 through 3.9.22. The globlal configuration page does not remove secrets from the HTML output, disclosing the current values.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-35611US	high7.5	1.35% (71st)	—	2020-12-28
An issue was discovered in Joomla! 2.5.0 through 3.9.22. The globlal configuration page does not remove secrets from the HTML output, disclosing the current values.

references

External citations — patches, advisories, analysis.

https://developer.joomla.org/security-centre/829-20201102-core-disclosure-of-secrets-in-global-configuration-page.htmlADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2020-35611WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan