Password hash exposed in CraftCMS two factor authentication plugin

ALTO 8.1CVE-2024-5657 · GHSA-3p4x-grpm-xw58 · Published 06/06/2024 · updated 17/06/2026

En resumen

CVE-2024-5657 es una vulnerabilidad ALTO (CVSS 8.1) que afecta a born05/craft-twofactorauthentication, two-factor authentication (born05).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.83%, mayor que el 57.8% de las vulnerabilidades.
Solución: actualizar a 3.3.4 o posterior.

Package	Affected versions	Patched versions
born05/craft-twofactorauthentication Packagist	`≥ 3.3.1, < 3.3.4`	`3.3.4`
two-factor authentication born05	`≥ 3.3.1, < 3.3.4`	`3.3.4`

Description

The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.

NVD description

The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.

References

nvd.nist.gov/vuln/detail/CVE-2024-5657 · ADVISORY
born05/craft-twofactorauthentication commit eb93bcb · WEB
born05/craft-twofactorauthentication · PACKAGE
born05/craft-twofactorauthentication release 3.3.4 · WEB
sbaresearch/advisories · WEB
plugins.craftcms.com/two-factor-authentication · WEB
openwall.com/lists/oss-security/2024/06/06/1 · WEB

Más vulnerabilidades de born05/craft-twofactorauthentication

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

born05/craft-twofactorauthentication

Packagist

≥ 3.3.1, < 3.3.4

3.3.4

two-factor authentication

born05

≥ 3.3.1, < 3.3.4

3.3.4

Description

The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.

NVD description

The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.