7.5

CVE-2024-41800

Craft CMS Allows TOTP Token To Stay Valid After Use

Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials. This has been patched in Craft 5.2.3.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Craftcms ≫ Craft Cms Version >= 5.0.1 < 5.2.3
Craftcms ≫ Craft Cms Version5.0.0 Updatebeta1
Craftcms ≫ Craft Cms Version5.0.0 Updatebeta10
Craftcms ≫ Craft Cms Version5.0.0 Updatebeta11
Craftcms ≫ Craft Cms Version5.0.0 Updatebeta2
Craftcms ≫ Craft Cms Version5.0.0 Updatebeta3
Craftcms ≫ Craft Cms Version5.0.0 Updatebeta4
Craftcms ≫ Craft Cms Version5.0.0 Updatebeta5
Craftcms ≫ Craft Cms Version5.0.0 Updatebeta6
Craftcms ≫ Craft Cms Version5.0.0 Updatebeta7
Craftcms ≫ Craft Cms Version5.0.0 Updatebeta8
Craftcms ≫ Craft Cms Version5.0.0 Updatebeta9
Craftcms ≫ Craft Cms Version5.0.0 Updaterc1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.43% 0.344
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 1.6 5.9
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
security-advisories@github.com 4.8 1.2 3.6
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

https://github.com/craftcms/cms/commit/7c790fa5ad5a8cb8016cb6793ec3554c4c079e38
Patch
https://github.com/craftcms/cms/releases/tag/5.2.3
Release Notes
https://github.com/craftcms/cms/security/advisories/GHSA-wmx7-pw49-88jx
Vendor Advisory
https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240617-01_CraftCMS_TOTP_Valid_After_Use
Third Party Advisory