CVE-2024-5657 CraftCMS Plugin - Two-Factor Authentication - Password Hash Disclosure
An attacker can obtain the authenticated user's password hash by submitting a valid TOTP code in the CraftCMS Two-Factor Authentication plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-5657?
CVE-2024-5657 is a low-severity vulnerability in Born05 CraftCMS Plugin - Two-Factor Authentication, published on 6 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.
Which versions are affected by CVE-2024-5657?
2 open source packages ship an affected version, including born05/craft-twofactorauthentication. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
born05/craft-twofactorauthentication Packagist | From 3.3.1 | 3.3.4 |
born05/craft-twofactorauthentication Packagist | From 3.3.1 | 3.3.4 |
Products include Born05 Two-Factor Authentication.
How do I fix CVE-2024-5657?
Upgrade born05/craft-twofactorauthentication to 3.3.4 or later.
Is CVE-2024-5657 being exploited?
There is no known exploitation of CVE-2024-5657 in the wild and no public exploit code.
Other vulnerabilities in Born05 CraftCMS Plugin - Two-Factor Authentication
Sources
Also known as GHSA-3p4x-grpm-xw58.