Skip to main content
mySites.guru
Free Audit
CriticalPHP2Shell is fixed, but a researcher now claims six more unpatched PHP flaws. Nothing to do today, but PHP is not out of the woodsWhat to prepare
CVE-2022-23802HighCVE published 6 May 2022

Guru (com_guru) <= 5.2.5 - Insecure Permissions / Information Disclosure

Guru is not mySites.guru

Guru is iJoomla's eLearning component for Joomla, installed as com_guru. The shared word in the two names is a coincidence: this vulnerability is in that extension, and there is no insecure permissions or information disclosure issue in the mySites.guru service. This page is part of the Joomla extension vulnerability database mySites.guru publishes.

iJoomla Guru 5.2.5 is affected by insecure permissions allowing an attacker to obtain sensitive information (CVE-2022-23802). Only 5.2.5 was tested; treat that version and below as affected until a fixed release is confirmed.

Is my site affected?

Affected
Guru up to and including 5.2.5
Fixed in
A release after 5.2.5
What to do
Update Guru to the newest release from the vendor. This flaw covers versions up to 5.2.5, so any later release is outside it.
Check whether your sites are affected

How severe CVE-2022-23802 is

The published CVE record has no CVSS score, so there is no vector to break down here. mySites.guru rates it High, and that is the rating your sites are checked against.

Timeline

  1. 6 May 2022CVE-2022-23802 record published by its CNA

Rule details

References

CVE-2022-23802 questions

Which versions are affected by CVE-2022-23802?
CVE-2022-23802 affects Guru up to and including 5.2.5.
How do I fix CVE-2022-23802?
Update Guru to the newest release from the vendor. This flaw covers versions up to 5.2.5, so any later release is outside it.
How severe is CVE-2022-23802?
The published CVE record has no CVSS score. mySites.guru rates it High.

Running an affected version on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

Rules current as of 25 October 2026.