GitHub Advisoryadvisory · Packagist

GHSA-3p4x-grpm-xw58 Password hash exposed in CraftCMS two factor authentication plugin

LOW Published 2024-06-06 Modified 2024-06-10 Official page ↗
Aliases
CVE-2024-5657
Ecosystem
Packagist
Packages
born05/craft-twofactorauthentication
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-522
Reviewed
2024-06-06

Affected packages

• Packagist born05/craft-twofactorauthentication: >= 3.3.1, < 3.3.4 → fixed in 3.3.4

Description

The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.

Related

Alias · CVE (1)

  • CVE-2024-5657 The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References