6.8
CVE-2013-0258
- EPSS 0.27%
- Veröffentlicht 27.03.2013 21:55:02
- Zuletzt bearbeitet 11.04.2025 00:51:21
- Quelle secalert@redhat.com
- Teams Watchlist Login
- Unerledigt Login
The Google Authenticator login (ga_login) module 7.x before 7.x-1.3 for Drupal, when multi-factor authentication is enabled, allows remote attackers to bypass authentication for accounts without an associated Google Authenticator token by logging in with the username.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Google Authenticator Login Project ≫ Ga Login Version7.x-1.0
Google Authenticator Login Project ≫ Ga Login Version7.x-1.0 Updatebeta1
Google Authenticator Login Project ≫ Ga Login Version7.x-1.0 Updatedev
Google Authenticator Login Project ≫ Ga Login Version7.x-1.1
Google Authenticator Login Project ≫ Ga Login Version7.x-1.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.27% | 0.47 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.8 | 8.6 | 6.4 |
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
CWE-287 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.