Lucene search

K
osvGoogleOSV:GO-2023-2386
HistoryDec 08, 2023 - 8:11 p.m.

Captcha verification bypass in github.com/mojocn/base64Captcha

2023-12-0820:11:50
Google
osv.dev
7
github
captcha
verification
bypass
default implementation
verify
mojocn/base64captcha
software

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

7.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.9%

When using the default implementation of Verify to check a Captcha, verification can be bypassed.

For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct.

CPENameOperatorVersion
github.com/mojocn/base64captchalt1.3.6

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

7.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.9%

Related for OSV:GO-2023-2386