CVE-2024-5658

The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
http://www.openwall.com/lists/oss-security/2024/06/06/2	Exploit Mailing List Third Party Advisory
https://github.com/born05/craft-twofactorauthentication/releases/tag/3.3.4	Release Notes
https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240202-02_CraftCMS_Plugin_Two-Factor_Authentication_TOTP_Valid_After_Use	Exploit Third Party Advisory
https://plugins.craftcms.com/two-factor-authentication?craft4	Product
http://www.openwall.com/lists/oss-security/2024/06/06/2	Exploit Mailing List Third Party Advisory
https://github.com/born05/craft-twofactorauthentication/releases/tag/3.3.4	Release Notes
https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240202-02_CraftCMS_Plugin_Two-Factor_Authentication_TOTP_Valid_After_Use	Exploit Third Party Advisory
https://plugins.craftcms.com/two-factor-authentication?craft4	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:born05:two-factor_authentication:*:*:*:*:*:craftcms:*:*

History

21 Nov 2024, 09:48

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~6.5~~	v2 : unknown v3 : 4.8
References	~~() http://www.openwall.com/lists/oss-security/2024/06/06/2 - Exploit, Mailing List, Third Party Advisory~~	() http://www.openwall.com/lists/oss-security/2024/06/06/2 - Exploit, Mailing List, Third Party Advisory
References	~~() https://github.com/born05/craft-twofactorauthentication/releases/tag/3.3.4 - Release Notes~~	() https://github.com/born05/craft-twofactorauthentication/releases/tag/3.3.4 - Release Notes
References	~~() https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240202-02_CraftCMS_Plugin_Two-Factor_Authentication_TOTP_Valid_After_Use - Exploit, Third Party Advisory~~	() https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240202-02_CraftCMS_Plugin_Two-Factor_Authentication_TOTP_Valid_After_Use - Exploit, Third Party Advisory
References	~~() https://plugins.craftcms.com/two-factor-authentication?craft4 - Product~~	() https://plugins.craftcms.com/two-factor-authentication?craft4 - Product

11 Jun 2024, 18:21

Type	Values Removed	Values Added
CPE		cpe:2.3:a:born05:two-factor_authentication::::::craftcms::*
First Time		Born05 Born05 two-factor Authentication
CVSS	v2 : ~~unknown~~ v3 : ~~4.8~~	v2 : unknown v3 : 6.5
References	~~() http://www.openwall.com/lists/oss-security/2024/06/06/2 -~~	() http://www.openwall.com/lists/oss-security/2024/06/06/2 - Exploit, Mailing List, Third Party Advisory
References	~~() https://github.com/born05/craft-twofactorauthentication/releases/tag/3.3.4 -~~	() https://github.com/born05/craft-twofactorauthentication/releases/tag/3.3.4 - Release Notes
References	~~() https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240202-02_CraftCMS_Plugin_Two-Factor_Authentication_TOTP_Valid_After_Use -~~	() https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240202-02_CraftCMS_Plugin_Two-Factor_Authentication_TOTP_Valid_After_Use - Exploit, Third Party Advisory
References	~~() https://plugins.craftcms.com/two-factor-authentication?craft4 -~~	() https://plugins.craftcms.com/two-factor-authentication?craft4 - Product

10 Jun 2024, 18:15

Type	Values Removed	Values Added
References		() http://www.openwall.com/lists/oss-security/2024/06/06/2 -

06 Jun 2024, 14:17

Type	Values Removed	Values Added
Summary		(es) El complemento CraftCMS Autenticación de dos factores hasta 3.3.3 permite la reutilización de tokens TOTP varias veces dentro del período de validez.

06 Jun 2024, 11:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-06-06 11:15

Updated : 2024-11-21 09:48

NVD link : CVE-2024-5658

Mitre link : CVE-2024-5658

CVE.ORG link : CVE-2024-5658

JSON object : View

Products Affected

born05

two-factor_authentication

CWE

CWE-287

Improper Authentication

4.8 /10