CVE-2024-41800CWE-287

Craft CMS Allows TOTP Token To Stay Valid After Use

Medium · published July 25, 2024

CVSS v3.1
4.8
EPSS
0%
Percentile
38.9
In the wild
Unconfirmed
What it is

Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials. This has been patched in Craft 5.2.3.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00459 · 38.9th percentile
Weakness
CWE-287 · Improper Authentication
Published
2024-07-25T16:12Z
EPSS history
Timeline
  • 25 JUL 16:12Z
    Craft CMS Allows TOTP Token To Stay Valid After Use
    cvelistv5