CVE-2023-23752
[20230201] - Core - Improper access check in webservice endpoints
- Published
- Feb 16, 2023
- Updated
- Feb 26, 2026
- Assigning CNA
- Joomla
- Evidence observed
- Apr 8, 2023
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NHigh · next 30 days
- Percentile
- 100.0%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.
Sources
modules/auxiliary/scanner/http/joomla_api_improper_access_checks.rb
Metasploit Framework modulesDeclared conditions
- verification: check_declared($.auxiliary_scanner/http/joomla_api_improper_access_checks.check)
joomla/CVE-2023-23752
Joomla improper access check in webservice endpoints (CVE-2023-23752)
Vulhub vulnerability labsDeclared conditions
- lab image version: vulhub/joomla:4.2.7(joomla/CVE-2023-23752/docker-compose.yml:services.web.image)
- lab image version: mysql:5.7(joomla/CVE-2023-23752/docker-compose.yml:services.mysql.image)
http/cves/2023/CVE-2023-23752.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: status,word($.matchers[*].type)
- CVE-2023-23752Exploit
Python exploit for Joomla information disclosure CVE-2023-23752, abusing unauthenticated webservice endpoints to extract configuration data and database credentials.
- CVE-2023-23752Exploit
Authentication bypass exploit for Joomla CVE-2023-23752 that leaks administrator credentials and MySQL configuration from vulnerable versions 4.00-4.28.
- CVE-2023-23752Exploit
A simple bash script to exploit Joomla! < 4.2.8 - Unauthenticated information disclosure
- CVE-2023-23752Exploit
Poc for CVE-2023-23752
- CVE-2023-23752Exploit
Joomla Unauthenticated Information Disclosure (CVE-2023-23752) exploit
- CVE-2023-23752Exploit
Perform With Mass Exploiter In Joomla 4.2.8.
- CVE-2023-23752Exploit
Python port of the CVE-2023-23752 exploit — Joomla! < 4.2.8 unauthenticated information disclosure (user list + DB credentials leak)
- CVE-2023-23752Scanner
Bulk vulnerability scanner for CVE-2023-23752 that extracts configuration data from vulnerable Joomla instances.
Proof-of-concept exploit for CVE-2023-23752 targeting unauthenticated information disclosure in Joomla! versions 4.0.0 to 4.2.7. Includes a Python script for automated exploitation.
- CVE-2023-23752Exploit
An access control flaw was identified, potentially leading to unauthorized access to critical webservice endpoints within Joomla! CMS versions 4.0.0 through 4.2.7. This vulnerability could be exploited by attackers to gain unauthorized access to sensitive information or perform unauthorized actions.
- CVE-2023-23752-PythonExploit
Joomla! < 4.2.8 - Unauthenticated information disclosure
- CVE-2023-23752Exploit
Exploit for CVE-2023-23752 (4.0.0 <= Joomla <= 4.2.7).
- CVE-2023-23752Exploit
Proof-of-concept exploit for CVE-2023-23752 (Joomla 4.0.0-4.2.8) that extracts usernames and passwords via an information disclosure vulnerability.
- CVE-2023-23752Exploit
Joomla! < 4.2.8 - Unauthenticated information disclosure exploit
- joombruteExploit
Modern Joomla Auth-attack Toolkit J3 / J4 / J5 - CVE-2023-23752 · CVE-2023-23755 · CVE-2025-25227
- CVE-2023-23752Exploit
CVE-2023-23752 nuclei template
- CVE-2023-23752Exploit
Python-based exploit for CVE-2023-23752 targeting Joomla 4.0.0-4.2.7 unauthorized REST API access, enabling sensitive information disclosure through crafted payloads.
- CVE-2023-23752Scanner
simple program for joomla CVE-2023-23752 scanner for pentesting and educational purpose
CVE-2023-23752 Unauthenticated Information Disclosure Showcase Using Devvortex From HTB.
CVE-2023-23752 Joomla 未授权访问漏洞 poc
- exploit-CVE-2023-23752Exploit
Joomla! < 4.2.8 - Unauthenticated information disclosure
- Joomla-ScannerScanner
CVE-2023-23752
- CVE-2023-23752Exploit
Exploit for CVE-2023-23752, a Joomla! information disclosure vulnerability, allowing unauthenticated access to configuration files.
- CVE-2023-23752Exploit
A bash automation that exploits the vulnerable endpoints for the Joomla! API 4.0 - 4.2.7
- CVE-2023-23752Exploit
Joomla Unauthorized Access Vulnerability
- CVE-2023-23752Exploit
CVE-2023-23752 Joomla Unauthenticated Information Disclosure
- Joomla-CVE-2023-23752Exploit
This Python implementation serves an educational purpose by demonstrating the exploitation of CVE-2023-23752. The code provides insight into the vulnerability's exploitation.
开源，go多并发批量探测poc，准确率高
- CVE-2023-23752Exploit
Go-based exploit for CVE-2023-23752 targeting Joomla CMS. Performs authenticated information disclosure and privilege escalation via a single command-line interface.
- CVE-2023-23752Exploit
Joomla! v4.2.8 - Unauthenticated information disclosure
- joomla_CVE-2023-23752Exploit
Nuclei template for exploiting Joomla unauthorized access vulnerability (CVE-2023-23752) to retrieve sensitive configuration data.
- Joomla-CVE-2023-23752Exploit
python 2.7
- CVE-2023-23752Exploit
CVE-2023-23752 Data Extractor
Dockerized proof-of-concept for Joomla unauthorized access vulnerability (CVE-2023-23752) enabling database credential extraction via API endpoint.
- CVE-2023-23752Exploit
Python exploit script for CVE-2023-23752 targeting unauthorized REST API access in Joomla 4.0.0–4.2.7, supporting single and batch scanning with proxy.
Joomla CVE-2023-23752 Exploit Script
A comprehensive full-lifecycle penetration testing project on Joomla 4.2.5 exploiting CVE-2023-23752 inside a Dockerized lab environment
- CVE-2023-23752Exploit
simple program for joomla scanner CVE-2023-23752 with target list
Traveller is an Easy Linux machine featuring a Joomla 4.2.7 travel booking website vulnerable to CVE-2023-23752, an unauthenticated REST API information disclosure that leaks database credentials, leading to admin panel access, remote code execution, and root via sudo misconfiguration.
- CVE-2023-23752Exploit
Joomla Information disclosure exploit code written in C++.
- CVE-2023-23752Exploit
Python exploit for Joomla! v4.2.8 unauthenticated information disclosure vulnerability (CVE-2023-23752). Extracts sensitive configuration data from vulnerable Joomla installations.
Poc for CVE-2023-23752 (joomla CMS)
- CVE-2023-23752Exploit
Joomla未授权访问漏洞
- joomla_CVE-2023-23752Exploit
Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.
CVE-2023-23752 poc
CVE-2023-23752
Joomla! 未授权访问漏洞
Alexandre ZANNI · php · Apr 8, 2023
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.