CVE-2022-42731

Опубликовано: 11 окт. 2022

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage.

Ссылки

https://github.com/mkalioby/django-mfa2/blob/0936ea253354dd95cb127f09d0efa31324caef27/mfa/FIDO2.py#L58
Exploit
Third Party Advisory
https://github.com/mkalioby/django-mfa2/releases/tag/v2.5.1-release
Release Notes
Third Party Advisory
https://github.com/mkalioby/django-mfa2/releases/tag/v2.6.1-release
Release Notes
Third Party Advisory
https://github.com/mkalioby/django-mfa2/blob/0936ea253354dd95cb127f09d0efa31324caef27/mfa/FIDO2.py#L58
Exploit
Third Party Advisory
https://github.com/mkalioby/django-mfa2/releases/tag/v2.5.1-release
Release Notes
Third Party Advisory
https://github.com/mkalioby/django-mfa2/releases/tag/v2.6.1-release
Release Notes
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:django-mfa2_project:django-mfa2:*:*:*:*:*:*:*:*

Версия до 2.5.1 (исключая)

cpe:2.3:a:django-mfa2_project:django-mfa2:*:*:*:*:*:*:*:*

Версия от 2.6.0 (включая) до 2.6.1 (исключая)

EPSS

Процентиль: 42%

0.00202

Низкий

7.5 High

CVSS3

Дефекты

CWE-294

Связанные уязвимости

GHSA-vw39-2wj9-4q86