BIT-joomla-2021-23128

vendorUSosv

[20210302] - Core - Potential Insecure FOFEncryptRandval

view advisory published 2025-04-03Licence: per source

An issue was discovered in Joomla! 3.2.0 through 3.9.24. The core shipped but unused randval implementation within FOF (FOFEncryptRandval) used an potential insecure implemetation. That has now been replaced with a call to 'random_bytes()' and its backport that is shipped within random_compat.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-23128US	critical9.1OT elevated	1.38% (72nd)	—	2021-03-04
An issue was discovered in Joomla! 3.2.0 through 3.9.24. The core shipped but unused randval implementation within FOF (FOFEncryptRandval) used an potential insecure implemetation.…

references

External citations — patches, advisories, analysis.

https://developer.joomla.org/security-centre/842-20210302-core-potential-insecure-fofencryptrandval.htmlADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2021-23128WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan