CVE-2023-23754: 
Joomla vulnerability analysis and mitigation

An issue was discovered in Joomla! versions 4.2.0 through 4.3.1, reported on February 28, 2023, and fixed on May 28, 2023. The vulnerability stems from a lack of input validation within the new MFA (Multi-Factor Authentication) selection screen, which resulted in open redirect and Cross-Site Scripting (XSS) vulnerabilities (Joomla Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The weakness types associated with this vulnerability include CWE-20 (Improper Input Validation), CWE-601 (URL Redirection to Untrusted Site), and CWE-79 (Cross-site Scripting) (NVD).

The vulnerability could allow attackers to perform open redirect attacks and execute cross-site scripting attacks through the MFA selection screen, potentially leading to user redirection to malicious sites and execution of unauthorized scripts in users' browsers (Joomla Advisory).

The vulnerability has been fixed in Joomla! version 4.3.2. Users are advised to upgrade to this version or later to protect against these security issues (Joomla Advisory).