Security readout for executives and security teams
Plain-English summary
Joomla’s search autosuggest could reveal terms linked to content that should be restricted by access level. This is mainly a confidentiality and access-control issue, not evidence of full site compromise in the supplied sources.
Executive priority
Prioritize remediation for internet-facing Joomla sites with restricted member, customer, or internal content. Business risk depends on the sensitivity of terms exposed through search suggestions.
Technical view
CVE-2020-35610 affects Joomla! CMS 2.5.0 through 3.9.22. The com_finder autosuggestion feature did not enforce access levels for corresponding terms, potentially exposing restricted indexed terms through autosuggest behavior.
Likely exposure
Public Joomla sites running affected versions and using com_finder autosuggest are the likely exposure. Evidence does not confirm whether all installations expose sensitive terms by default.
Exploitation context
The supplied bundle does not cite active exploitation, public exploit use, or CISA KEV listing. Treat exploitation status as unconfirmed.
Researcher notes
The source bundle lacks CVSS, CWE, detailed exploit prerequisites, and explicit fixed-version text. Analysis is limited to the stated access-level bypass in com_finder autosuggest and affected Joomla version range.
Mitigation direction
- Check the Joomla vendor advisory for the corrected release path.
- Upgrade affected Joomla CMS installations to a vendor-supported fixed version.
- Disable or restrict com_finder autosuggest if immediate upgrade is not possible.
- Review indexed restricted content for sensitive terminology exposure.
Validation and detection
- Inventory Joomla CMS versions and flag 2.5.0 through 3.9.22.
- Confirm whether com_finder and autosuggest are enabled on public routes.
- Verify restricted content terms are not exposed through autosuggest behavior.
- Confirm remediation against the Joomla advisory and change records.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-35610 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://developer.joomla.org/security-centre/828-20201101-core-com-finder-ignores-access-levels-on-autosuggest.htmlCVE reference · x_refsource_MISC, vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.