Password hash exposed in CraftCMS two factor authentication plugin

높음 8.1CVE-2024-5657 · GHSA-3p4x-grpm-xw58 · Published 06/06/2024 · updated 17/06/2026

요약

CVE-2024-5657은(는) born05/craft-twofactorauthentication, two-factor authentication (born05)에 영향을 주는 높음 (CVSS 8.1) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.83%, 전체 취약점의 57.8%보다 높음.
조치: 3.3.4 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
born05/craft-twofactorauthentication Packagist	`≥ 3.3.1, < 3.3.4`	`3.3.4`
two-factor authentication born05	`≥ 3.3.1, < 3.3.4`	`3.3.4`

Description

The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.

NVD description

The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.

References

nvd.nist.gov/vuln/detail/CVE-2024-5657 · ADVISORY
born05/craft-twofactorauthentication commit eb93bcb · WEB
born05/craft-twofactorauthentication · PACKAGE
born05/craft-twofactorauthentication release 3.3.4 · WEB
sbaresearch/advisories · WEB
plugins.craftcms.com/two-factor-authentication · WEB
openwall.com/lists/oss-security/2024/06/06/1 · WEB

born05/craft-twofactorauthentication의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

born05/craft-twofactorauthentication

Packagist

≥ 3.3.1, < 3.3.4

3.3.4

two-factor authentication

born05

≥ 3.3.1, < 3.3.4

3.3.4

Description

The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.

NVD description

The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.