Potential CVE-2023-23752 Exploitation Attempt on Joomla

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

This rule detects potential exploitation attempts of CVE-2023-23752, an improper access check vulnerability in Joomla's web service endpoints. The detection specifically looks for GET requests to the '/api/index.php/v1/' path with the 'public=true' query parameter, which is indicative of an attempt to bypass access controls.