CVE-2024-21722 — Insufficient Session Expiration in Joomla !

CWE-613 — Insufficient Session Expiration5 documents5 sources
Severity
6.3MEDIUMNVD
EPSS
0.0%
top 99.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Joomla !Joomla! Project Joomla! CMS
Timeline
PublishedFeb 29
Latest updateDec 15

Description

The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LExploitability: 2.8 | Impact: 3.4

Affected Packages2 packages

▶NVDjoomla/joomla_!3.2.0 — 3.10.15+2
▶CVEListV5joomla!_project/joomla!_cms3.2.0-3.10.14, 4.0.0-4.4.2, 5.0.0-5.0.2+2

🔴Vulnerability Details

3
OSV
linux-fips vulnerabilities↗2025-12-15
▶
GHSA
GHSA-h4pg-prwh-f695: The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified↗2024-02-29
▶
CVEList
[20240201] - Core - Insufficient session expiration in MFA management views↗2024-02-20
▶

🕵️Threat Intelligence

1
Bleepingcomputer
Joomla fixes XSS flaws that could expose sites to RCE attacks↗2024-02-21
▶
CVE-2024-21722 — Insufficient Session Expiration | cvebase