Description
The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.
References (4)
Core 4
Core References
Exploit, Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/06/06/1
Exploit, Third Party Advisory third-party-advisory
https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240202-01_CraftCMS_Plugin_Two-Factor_Authentication_Password_Hash_Disclosure
Product product
https://plugins.craftcms.com/two-factor-authentication?craft4
Release Notes release-notes
https://github.com/born05/craft-twofactorauthentication/releases/tag/3.3.4
Scores
CVSS v3
3.7
EPSS
0.0021
EPSS Percentile
42.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-522
CWE-499
Status
published
Products (2)
born05/craft-twofactorauthentication
3.3.1 - 3.3.4Packagist
born05/two-factor_authentication
3.3.1 - 3.3.4
Published
Jun 06, 2024
Tracked Since
Feb 18, 2026