7.5

CVE-2024-41800

Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials. This has been patched in Craft 5.2.3.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Craftcms ≫ Craft Cms Version >= 5.0.1 < 5.2.3
Craftcms ≫ Craft Cms Version5.0.0 Updatebeta1
Craftcms ≫ Craft Cms Version5.0.0 Updatebeta10
Craftcms ≫ Craft Cms Version5.0.0 Updatebeta11
Craftcms ≫ Craft Cms Version5.0.0 Updatebeta2
Craftcms ≫ Craft Cms Version5.0.0 Updatebeta3
Craftcms ≫ Craft Cms Version5.0.0 Updatebeta4
Craftcms ≫ Craft Cms Version5.0.0 Updatebeta5
Craftcms ≫ Craft Cms Version5.0.0 Updatebeta6
Craftcms ≫ Craft Cms Version5.0.0 Updatebeta7
Craftcms ≫ Craft Cms Version5.0.0 Updatebeta8
Craftcms ≫ Craft Cms Version5.0.0 Updatebeta9
Craftcms ≫ Craft Cms Version5.0.0 Updaterc1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.34% 0.56
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 1.6 5.9
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
security-advisories@github.com 4.8 1.2 3.6
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.