GitHub Advisoryadvisory · Go

GHSA-5mmw-p5qv-w3x5 Always incorrect control flow in github.com/mojocn/base64Captcha

MEDIUM Published 2023-12-12 Modified 2023-12-14 Official page ↗
Aliases
CVE-2023-45292
Ecosystem
Go
Packages
github.com/mojocn/base64Captcha
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-345, CWE-670
Reviewed
2023-12-12

Affected packages

• Go github.com/mojocn/base64Captcha: < 1.3.6 → fixed in 1.3.6

Description

When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct.

Related

Alias · CVE (1)

  • CVE-2023-45292 When using the default implementation of Verify to check a Captcha, verification can be bypassed. vulnerability

Weakness · CWE (2)

  • CWE-345 Insufficient Verification of Data Authenticity weakness
  • CWE-670 Always-Incorrect Control Flow Implementation weakness

References