CVE-2024-21725

Description

Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components.

Reserved 2024-01-01 | Published 2024-02-20 | Updated 2024-10-28 | Assigner Joomla

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Default status
unaffected

4.0.0-4.4.2
affected

5.0.0-5.0.2
affected

Credits

Gareth Heyes (PortSwigger Research) finder

References

developer.joomla.org/...ore-xss-in-mail-address-outputs.html vendor-advisory

cve.org (CVE-2024-21725)

nvd.nist.gov (CVE-2024-21725)

Download JSON