[20250101] - Core - XSS vectors in module chromes

Project: Joomla!
SubProject: CMS
Impact: Low
Severity: Moderate
Probability: Low
Versions: 4.0.0-4.4.9, 5.0.0-5.2.2
Exploit type: XSS
Reported Date: 2024-08-29
Fixed Date: 2025-01-07
CVE Number: CVE-2024-40747

Description

Various module chromes didn't properly process inputs, leading to XSS vectors.

Affected Installs

Joomla! CMS versions 4.0.0-4.4.9, 5.0.0-5.2.2

Solution

Upgrade to version 4.4.10 or 5.2.3

Contact

The JSST at the Joomla! Security Centre.

Reported By: Catalin Iovita