CVE-2024-41800

Katalog CVE

CVSS 7.5 · High EPSS 0,46%

Kerentanan Improper Authentication pada craftcms craft cms. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials. This has been patched in Craft 5.2.3.

Rincian

Terbit di NVD

25 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 38,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/craftcms/cms/security/advisories/GHSA-wmx7-pw49-88jx advisory vendor
• https://github.com/craftcms/cms/commit/7c790fa5ad5a8cb8016cb6793ec3554c4c079e38 patch
• https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240617-01_CraftCMS_TOTP_Valid_After_Use advisory pihak ketiga
• https://github.com/craftcms/cms/releases/tag/5.2.3 release notes