Joomla CVE-2023-23752: Unauthenticated API Leaks DB Password
A medium score hides a database-password leak that has been mass-scanned since 2023; any site that ran Joomla 4.0.0-4.2.7 should be upgraded off the unsupported 4.x line and have its leaked secrets rotated.
Must act: Owners of Joomla sites that ran 4.0.0 through 4.2.7 on the public internet, and anyone still on the unsupported Joomla 4 line.
Can relax: Sites that were never on Joomla 4.0.0-4.2.7 (Joomla 3.x and 5.x+ are outside the affected range) and that run a supported release today.
- Find the version of every Joomla site: grep -m1 '<version>' administrator/manifests/files/joomla.xml.
- Upgrade any 4.x site to a supported Joomla major version; 4.x no longer receives fixes.
- If a site ever ran 4.0.0-4.2.7 publicly, change the database password and the secret in configuration.php, and reset Super User passwords.