DRUPAL-CONTRIB-2023-030 This module enables you to allow and/or require users to use a second authentication method in addition to password authentication.
Attackers with valid credentials can bypass two-factor authentication on password reset routes, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2023-030?
DRUPAL-CONTRIB-2023-030 is an authentication bypass vulnerability in drupal/tfa, published on 12 Jul 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
This module enables you to allow and/or require users to use a second authentication method in addition to password authentication.
The module doesn't sufficiently ensure all core login routes, including the password reset page, require a second factor credential.
This vulnerability is mitigated by the fact that an attacker must obtain a first-factor login credential.
Which versions are affected by DRUPAL-CONTRIB-2023-030?
Linux distribution packages (1)
drupal/tfa Packagist:https://packages.drupal.org/8 | From 1.0.0 | 1.1.0 |
How do I fix DRUPAL-CONTRIB-2023-030?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is DRUPAL-CONTRIB-2023-030 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2023-030 in the wild and no public exploit code.