BIT-joomla-2021-23127

vendorUSosv

[20210301] - Core - Insecure randomness within 2FA secret generation

view advisory published 2025-04-03Licence: per source

An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-23127US	critical9.1OT elevated	1.38% (72nd)	—	2021-03-04
An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes.

references

External citations — patches, advisories, analysis.

https://developer.joomla.org/security-centre/841-20210301-core-insecure-randomness-within-2fa-secret-generation.htmlADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2021-23127WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan