CVE-2020-35611: 
Joomla vulnerability analysis and mitigation

CVE-2020-35611 is a security vulnerability discovered in Joomla! versions 2.5.0 through 3.9.22. The vulnerability was disclosed on September 23, 2020, and fixed on November 24, 2020. The issue involves the global configuration page failing to remove secrets from the HTML output, potentially exposing sensitive configuration values (Vendor Advisory).

The vulnerability is classified as an Information Disclosure issue with moderate impact and low severity. It affects the global configuration page functionality where sensitive configuration values are not properly sanitized before being included in the HTML output. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 HIGH with the vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD).

The vulnerability could lead to the disclosure of sensitive configuration information to unauthorized users. This exposure of secrets in the global configuration page could potentially provide attackers with valuable system information that could be used in further attacks.

The vulnerability is classified as an information disclosure type that can expose sensitive information to unauthorized actors. It has been categorized under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) (NVD).

The vulnerability was patched in Joomla! version 3.9.23. Users running affected versions (2.5.0 through 3.9.22) should upgrade to version 3.9.23 or later to mitigate this security issue (Vendor Advisory).