CVE-2021-23124: 
Joomla vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability was discovered in Joomla! versions 3.9.0 through 3.9.23, identified as CVE-2021-23124. The vulnerability was reported on September 1, 2020, and fixed on January 12, 2021. The issue stems from insufficient escaping in the mod_breadcrumbs aria-label attribute, which could allow attackers to execute XSS attacks (Joomla Security).

The vulnerability is classified with a CVSS v3.1 score of 6.1 (MEDIUM) and CVSS v2.0 score of 4.3 (MEDIUM). The core issue lies in the mod_breadcrumbs component of Joomla!, specifically in the handling of the aria-label attribute, where proper input validation and escaping mechanisms were not implemented (NVD Database).

The exploitation of this vulnerability could lead to cross-site scripting attacks, potentially allowing attackers to inject malicious scripts into the affected Joomla! installations. This could result in unauthorized access to user data and compromise of the web application's security (CERT-FR).

The vulnerability requires an attacker to have access to input fields that affect the mod_breadcrumbs component. The severity is rated as 'Low' by the Joomla! Security Team, despite its moderate impact potential (Joomla Security).

The vulnerability was addressed in Joomla! version 3.9.24. Users running affected versions (3.9.0 through 3.9.23) are advised to upgrade to version 3.9.24 or later to mitigate this security risk (Joomla Security).