Rapid7 Vulnerability & Exploit Database

Joomla!: [20210301] - Core - Insecure randomness within 2FA secret generation (CVE-2021-23126)

Back to Search

Joomla!: [20210301] - Core - Insecure randomness within 2FA secret generation (CVE-2021-23126)

Severity
6
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:N)
Published
03/03/2021
Created
03/04/2021
Added
03/03/2021
Modified
03/08/2021

Description

An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes.

Solution(s)

  • joomla-upgrade-3_9_25

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;