The Joomla API application reflected any incoming Origin header back in Access-Control-Allow-Origin and set Access-Control-Allow-Credentials: true, so the configured cors_allow_origin whitelist was never enforced. Any website could therefore make credentialed cross-origin requests to the site’s web services API and read the responses, exposing data available to the victim’s API session. The fix validates the request origin against the configured whitelist and only allows credentials for a validated origin.
This vulnerability affects the following application versions:
- Joomla 4.0.0
- Joomla 4.0.1
- Joomla 4.0.2
- Joomla 4.0.3
- Joomla 4.0.4
- Joomla 4.0.5
- Joomla 4.0.6
- Joomla 4.1.0
- Joomla 4.1.1
- Joomla 4.1.2
- Joomla 4.1.3
- Joomla 4.1.4
- Joomla 4.1.5
- Joomla 4.2.0
- Joomla 4.2.1
- Joomla 4.2.2
- Joomla 4.2.3
- Joomla 4.2.4
- Joomla 4.2.5
- Joomla 4.2.6
- Joomla 4.2.7
- Joomla 4.2.8
- Joomla 4.2.9
- Joomla 4.3.0
- Joomla 4.3.1
- Joomla 4.3.2
- Joomla 4.3.3
- Joomla 4.3.4
- Joomla 4.4.0
- Joomla 4.4.1
- Joomla 4.4.2
- Joomla 4.4.3
- Joomla 4.4.4
- Joomla 4.4.5
- Joomla 4.4.6
- Joomla 4.4.7
- Joomla 4.4.8
- Joomla 4.4.9
- Joomla 4.4.10
- Joomla 4.4.11
- Joomla 4.4.12
- Joomla 4.4.13
- Joomla 4.4.14
- Joomla 5.0.0
- Joomla 5.0.1
- Joomla 5.0.2
- Joomla 5.0.3
- Joomla 5.1.0
- Joomla 5.1.1
- Joomla 5.1.2
- Joomla 5.1.3
- Joomla 5.1.4
- Joomla 5.2.0
- Joomla 5.2.1
- Joomla 5.2.2
- Joomla 5.2.3
- Joomla 5.2.4
- Joomla 5.2.5
- Joomla 5.2.6
- Joomla 5.3.0
- Joomla 5.3.1
- Joomla 5.3.2
- Joomla 5.3.3
- Joomla 5.3.4
- Joomla 5.4.0
- Joomla 5.4.1
- Joomla 5.4.2
- Joomla 5.4.3
- Joomla 5.4.4
- Joomla 5.4.5
- Joomla 5.4.6
- Joomla 5.4.7
- Joomla 6.0.0
- Joomla 6.0.1
- Joomla 6.0.2
- Joomla 6.0.3
- Joomla 6.0.4
- Joomla 6.1.0
- Joomla 6.1.1
- Joomla 6.1.2