CVE-2024-21722

Published: Feb 29, 2024Modified: Jun 2, 2025

6.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Exploitability: 2.8 / Impact: 3.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified.

Affected (3)

Products: Joomla: Joomla!

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Joomla Joomla!	From 3.2.0 to 3.10.15
Joomla Joomla!	From 4.0.0 to 4.4.3
Joomla Joomla!	From 5.0.0 to 5.0.3

Related CWEs

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (2)

https://developer.joomla.org/security-centre/925-20240201-core-insufficient-session-expiration-in-mfa-management-views.html

Source: security@joomla.org

Vendor Advisory

https://developer.joomla.org/security-centre/925-20240201-core-insufficient-session-expiration-in-mfa-management-views.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.