CVEvulnerability
CVE-2022-28601
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2022-05-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-863
Description
A Two-Factor Authentication (2FA) bypass vulnerability in "Simple 2FA Plugin for Moodle" by LMS Doctor allows remote attackers to overwrite the phone number used for confirmation via the profile.php file. Therefore, allowing them to bypass the phone verification mechanism.
Affected configurations
• lmsdoctor 2 factor authentication
Related
Weakness · CWE (1)
- CWE-863 Incorrect Authorization weakness
References
- https://github.com/FlaviuPopescu/CVE-2022-28601 Exploit, Third Party Advisory
- https://www.lmsdoctor.com/simple-2-factor-authentication-plugin-for-moodle Product
- https://github.com/FlaviuPopescu/CVE-2022-28601 Exploit, Third Party Advisory
- https://www.lmsdoctor.com/simple-2-factor-authentication-plugin-for-moodle Product