PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-54357 Artio CVE debrief

CVE-2023-54357 is a high-severity information disclosure vulnerability in the Joomla com_booking component version 2.4.9. This vulnerability allows unauthenticated attackers to enumerate user accounts by exploiting the getUserData function in the customer controller. Attackers can send GET requests to index.php with specific parameters to retrieve user names, usernames, and email addresses through brute force enumeration. The CVSS score for this vulnerability is 8.7, indicating a high severity level. Organizations using the affected component should prioritize patching to limit exposure.

Vendor
Artio
Product
Joomla! com_booking component
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-19
Original CVE updated
2026-08-21
Advisory published
2026-06-19
Advisory updated
2026-08-21

Who should care

Administrators and security teams responsible for Joomla installations, particularly those using the com_booking component version 2.4.9, should be aware of this vulnerability. Given the high severity and potential for exploitation, immediate attention is necessary to protect against potential attacks.

Technical summary

The CVE-2023-54357 vulnerability is caused by an insecure implementation of the getUserData function in the customer controller of the Joomla com_booking component. This function allows unauthenticated access to user data, including names, usernames, and email addresses. The vulnerability can be exploited by sending crafted GET requests to index.php with option=com_booking, controller=customer, task=getUserData, and an id parameter. Successful exploitation could lead to user account enumeration and potential information disclosure.

Defensive priority

High priority due to CVSS score of 8.7 and potential for easy exploitation.

Recommended defensive actions

  • Apply the latest patch or update for the Joomla com_booking component to version 2.4.10 or later.
  • Restrict access to the customer controller and getUserData function to authenticated users only.
  • Implement rate limiting on requests to index.php to prevent brute force enumeration.
  • Monitor Joomla installations for suspicious activity related to the com_booking component.
  • Perform a thorough review of user accounts and email addresses for any signs of enumeration or unauthorized access.

Evidence notes

The primary evidence for this vulnerability comes from the CVE-2023-54357 record and the NVD detail page. The affected product is the Joomla com_booking component version 2.4.9. Evidence limits are based on information provided by the CVE and NVD sources. Defenders should verify the vulnerability status and affected versions from official Joomla and CVE/NVD sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-54357 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-54357

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-54357 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-54357

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.