CVE-2024-5657: falha de baixa gravidade em Born05 CraftCMS Plugin - Two-Factor…
CraftCMS Plugin - Two-Factor Authentication - Password Hash Disclosure
Publicada em · Atualizada em
Seguir esta CVE+ Monitorar CraftCMS Plugin - Two-Factor Authentication+ Monitorar born05/craft-twofactorauthentication
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 3.7epss 0.8%
The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
Born05 · CraftCMS Plugin - Two-Factor AuthenticationCVEs relacionadas — Born05 CraftCMS Plugin - Two-Factor…
No mesmo produto, das mais perigosas para as menos.
Referências
https://github.com/born05/craft-twofactorauthentication/releases/tag/3.3.4https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240202-01_CraftCMS_Plugin_Two-Factor_Authentication_Password_Hash_Disclosurehttps://plugins.craftcms.com/two-factor-authentication?craft4http://www.openwall.com/lists/oss-security/2024/06/06/1