CVE-2023-36816: falha de média gravidade em Bubka 2FAuth
Cross-Site Scripting (XSS) at Account creation in 2FAuth
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.1epss 0.5%
2FA is a Web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Cross site scripting (XSS) injection can be done via the account/service field. This was tested in docker-compose environment. This vulnerability has been patched in version 4.0.3.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Produtos afetados
Bubka · 2FAuthCVEs relacionadas — Bubka 2FAuth
No mesmo produto, das mais perigosas para as menos.
CVE-2024-52598HIGH2FAuth vulnerable to Server Side Request Forgery + URI validation bypass in 2fauth /api/v1/twofaccounts/previewEPSS 0.6%CVE-2026-32133HIGH2FAuth has Blind SSRF in image parameter allows internal network access and moreEPSS 0.5%CVE-2024-52597MEDIUM2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access renderEPSS 0.4%CVE-2026-63439CRITICAL2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy VerificationEPSS —CVE-2026-63438CRITICAL2FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header ValueEPSS —CVE-2026-63440MEDIUM2FAuth: Authenticated SSRF via DNS rebinding in the otpauth image= icon fetch (validate-then-fetch TOCTOU)EPSS —