CVE-2023-54360

Joomla JLex Review 6.0.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating the review_id URL parameter. Attackers can craft malicious links containing JavaScript payloads that execute in victims' browsers when clicked, enabling session hijacking or credential theft.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://extensions.joomla.org/extension/jlex-review/
https://jlexart.com/
https://www.exploit-db.com/exploits/51645
https://www.vulncheck.com/advisories/joomla-jlex-review-reflected-xss-via-review-id-parameter

Configurations

No configuration.

History

26 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Joomla JLex Review 6.0.1 contiene una vulnerabilidad de cross-site scripting reflejada que permite a los atacantes inyectar scripts maliciosos manipulando el parámetro URL review_id. Los atacantes pueden crear enlaces maliciosos que contienen cargas útiles de JavaScript que se ejecutan en los navegadores de las víctimas al hacer clic, lo que permite el secuestro de sesión o el robo de credenciales.

Information

Published : 2026-04-09 21:16

Updated : 2026-09-26 23:10

NVD link : CVE-2023-54360

Mitre link : CVE-2023-54360

CVE.ORG link : CVE-2023-54360

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2023-54360", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-54360", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T20:22:58.610548Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Jlexart", "product": "Joomla JLex Review", "versions": [{"status": "affected", "version": "6.0.1"}]}]}], "published": "2026-04-09T21:16:05.340", "references": [{"url": "https://extensions.joomla.org/extension/jlex-review/", "source": "disclosure@vulncheck.com"}, {"url": "https://jlexart.com/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/51645", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/joomla-jlex-review-reflected-xss-via-review-id-parameter", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Joomla JLex Review 6.0.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating the review_id URL parameter. Attackers can craft malicious links containing JavaScript payloads that execute in victims' browsers when clicked, enabling session hijacking or credential theft."}, {"lang": "es", "value": "Joomla JLex Review 6.0.1 contiene una vulnerabilidad de cross-site scripting reflejada que permite a los atacantes inyectar scripts maliciosos manipulando el par\u00e1metro URL review_id. Los atacantes pueden crear enlaces maliciosos que contienen cargas \u00fatiles de JavaScript que se ejecutan en los navegadores de las v\u00edctimas al hacer clic, lo que permite el secuestro de sesi\u00f3n o el robo de credenciales."}], "lastModified": "2026-09-26T23:10:00.127", "sourceIdentifier": "disclosure@vulncheck.com"}