Lucene search

GoogleOSV:GHSA-96QM-HWHP-2RM8

HistoryJun 06, 2024 - 12:30 p.m.

Improper Authentication in CraftCMS two factor authentication plugin

2024-06-0612:30:36

Google

osv.dev

craftcms

two-factor authentication

totp tokens

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

27.0%

JSON

The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period.

CPENameOperatorVersion
born05/craft-twofactorauthenticationeq3.3.1
born05/craft-twofactorauthenticationeq0.0.5
born05/craft-twofactorauthenticationeq2.0.0-beta.6
born05/craft-twofactorauthenticationeq3.3.3
born05/craft-twofactorauthenticationeq2.0.0-beta.14
born05/craft-twofactorauthenticationeq2.0.0-beta.2
born05/craft-twofactorauthenticationeq2.0.0-beta.8
born05/craft-twofactorauthenticationeq3.0.0
born05/craft-twofactorauthenticationeq2.11.0
born05/craft-twofactorauthenticationeq2.7.3

Name	Operator	Version
born05/craft-twofactorauthentication	eq	3.3.1
born05/craft-twofactorauthentication	eq	0.0.5
born05/craft-twofactorauthentication	eq	2.0.0-beta.6
born05/craft-twofactorauthentication	eq	3.3.3
born05/craft-twofactorauthentication	eq	2.0.0-beta.14
born05/craft-twofactorauthentication	eq	2.0.0-beta.2
born05/craft-twofactorauthentication	eq	2.0.0-beta.8
born05/craft-twofactorauthentication	eq	3.0.0
born05/craft-twofactorauthentication	eq	2.11.0
born05/craft-twofactorauthentication	eq	2.7.3

Rows per page:

1-10 of 631

References

www.openwall.com/lists/oss-security/2024/06/06/2

github.com/born05/craft-twofactorauthentication

github.com/born05/craft-twofactorauthentication/commit/89d2339463c0f3ee690e707d4bc8501360885289

github.com/born05/craft-twofactorauthentication/releases/tag/3.3.4

github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240202-02_CraftCMS_Plugin_Two-Factor_Authentication_TOTP_Valid_After_Use

nvd.nist.gov/vuln/detail/CVE-2024-5658

plugins.craftcms.com/two-factor-authentication?craft4

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

27.0%

JSON

Related for OSV:GHSA-96QM-HWHP-2RM8