CVE-2024-5657

CVE Database · CVE-2024-5657

CVE-2024-5657

· LOWModified

CVSS v3.1

3.7

EPSS

0.83%

Published

Jun 6, 2024

Modified

Sep 3, 2025

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-499CWE-522

Affected Products (1)

born05 · two-factor_authentication (up to 3.3.4)vulnerable

References (8)

http://www.openwall.com/lists/oss-security/2024/06/06/1

ExploitMailing ListThird Party Advisory

https://github.com/born05/craft-twofactorauthentication/releases/tag/3.3.4

Release Notes

https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240202-01_CraftCMS_Plugin_Two-Factor_Authentication_Password_Hash_Disclosure

ExploitThird Party Advisory

https://plugins.craftcms.com/two-factor-authentication?craft4

Product

http://www.openwall.com/lists/oss-security/2024/06/06/1

ExploitMailing ListThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs