CVE-2013-0258

Google Authenticator Login Module for Drupal 7.x - Unauthenticated Authentication Bypass

Title source: llm
STIX 2.1

Description

The Google Authenticator login (ga_login) module 7.x before 7.x-1.3 for Drupal, when multi-factor authentication is enabled, allows remote attackers to bypass authentication for accounts without an associated Google Authenticator token by logging in with the username.

References (4)

Core 4
Core References
Patch, Vendor Advisory x_refsource_misc
http://drupal.org/node/1903282
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2013/02/05/1
Patch x_refsource_confirm
http://drupal.org/node/1902102

Scores

EPSS 0.0139
EPSS Percentile 69.0%

Details

CWE
CWE-287
Status published
Products (3)
google_authenticator_login_project/ga_login 7.x-1.0 (3 CPE variants)
google_authenticator_login_project/ga_login 7.x-1.1
google_authenticator_login_project/ga_login 7.x-1.2
Published Mar 27, 2013
Tracked Since Feb 18, 2026