CVE-2013-0258

2022-10-0316:15:04

CWE-287

[email protected]

web.nvd.nist.gov

google authenticator

multi-factor authentication

drupal 7.x

cve-2013-0258

6.9 Medium

AI Score

Confidence

Low

6.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

74.7%

JSON

The Google Authenticator login (ga_login) module 7.x before 7.x-1.3 for Drupal, when multi-factor authentication is enabled, allows remote attackers to bypass authentication for accounts without an associated Google Authenticator token by logging in with the username.

Affected configurations

NVD

Node

google_authenticator_login_projectga_loginMatch7.x-1.0

google_authenticator_login_projectga_loginMatch7.x-1.0beta1

google_authenticator_login_projectga_loginMatch7.x-1.0dev

google_authenticator_login_projectga_loginMatch7.x-1.1

google_authenticator_login_projectga_loginMatch7.x-1.2

AND

drupaldrupalMatch-

CPENameOperatorVersion
google_authenticator_login_project:ga_logingoogle authenticator login project ga logineq7.x-1.0
google_authenticator_login_project:ga_logingoogle authenticator login project ga logineq7.x-1.1
google_authenticator_login_project:ga_logingoogle authenticator login project ga logineq7.x-1.2

CPE	Name	Operator	Version
google_authenticator_login_project:ga_login	google authenticator login project ga login	eq	7.x-1.0
google_authenticator_login_project:ga_login	google authenticator login project ga login	eq	7.x-1.1
google_authenticator_login_project:ga_login	google authenticator login project ga login	eq	7.x-1.2