CVE-2024-5657
06.06.2024, 11:15
The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.Enginsight
| Vendor | Product | Version |
|---|---|---|
| born05 | two-factor_authentication | 3.3.1 ≤ 𝑥 < 3.3.4 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-499 - Serializable Class Containing Sensitive DataThe code contains a class with sensitive data, but the class does not explicitly deny serialization. The data can be accessed by serializing the class through another class.
- CWE-522 - Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
References