Vulnerabilities

TI-2024-05253 CVE-2024-5658 · GHSA-96qm-hwhp-2rm8

CraftCMS Plugin - Two-Factor Authentication - TOTP Token Stays Valid After Use

LOW 30

The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00588 Published 2024-06-06 Fixed in 3.3.4 CWE-303

TI-2024-05252 CVE-2024-5657 · GHSA-3p4x-grpm-xw58

CraftCMS Plugin - Two-Factor Authentication - Password Hash Disclosure

LOW 37

The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00832 Published 2024-06-06 Fixed in 3.3.4 CWE-499

Vulnerabilities

Filters

CraftCMS Plugin - Two-Factor Authentication - TOTP Token Stays Valid After Use

CraftCMS Plugin - Two-Factor Authentication - Password Hash Disclosure