{"id":"CVE-2024-5657","aliases":["EUVD-2024-1903","GHSA-3p4x-grpm-xw58"],"status":"published","title":"CraftCMS Plugin - Two-Factor Authentication - Password Hash Disclosure","description":"The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00832,"percentile":0.57858,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-499","CWE-522"],"published":"2024-06-06T10:29:40Z","modified":"2026-10-28T02:30:40Z","fixes":[{"ecosystem":"Packagist","package":"born05/craft-twofactorauthentication","fixed_in":["3.3.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"born05/craft-twofactorauthentication","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.1"},{"fixed":"3.3.4"}]}]},{"source":"osv","ecosystem":"Packagist","package":"born05/craft-twofactorauthentication","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.1"},{"fixed":"3.3.4"}]}],"versions":["3.3.1","3.3.2","3.3.3"]}],"products":[{"vendor":"born05","product":"craftcms plugin - two-factor authentication"},{"vendor":"born05","product":"two-factor_authentication"}],"references":[{"url":"https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240202-01_CraftCMS_Plugin_Two-Factor_Authentication_Password_Hash_Disclosure","tags":["third-party-advisory","x_transferred","Exploit","Third Party Advisory","advisory","web"]},{"url":"https://plugins.craftcms.com/two-factor-authentication?craft4","tags":["product","x_transferred","Product","web"]},{"url":"https://github.com/born05/craft-twofactorauthentication/releases/tag/3.3.4","tags":["release-notes","x_transferred","Release Notes","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/06/06/1","tags":["x_transferred","Exploit","Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5657","tags":["advisory"]},{"url":"https://github.com/born05/craft-twofactorauthentication/commit/eb93bcb73037171dae8ca5cfa4c20e7e5748b73a","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3p4x-grpm-xw58"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/5xxx/CVE-2024-5657.json","tags":["advisory"]},{"url":"https://github.com/born05/craft-twofactorauthentication","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-5657","title":"CraftCMS Plugin - Two-Factor Authentication - Password Hash Disclosure","description":"The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.","status":"published","published":"2024-06-06T10:29:40.393Z","modified":"2025-09-03T07:13:32.028Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-499"],"updated_at":"2026-11-02T14:34:01.630882Z"}],"euvd":[{"id":"EUVD-2024-1903","description":"The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.","status":"published","published":"2024-06-06T10:29:40Z","modified":"2025-09-03T07:13:32Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T20:31:48.3448Z"}],"ghsa":[{"id":"GHSA-3p4x-grpm-xw58","title":"Password hash exposed in CraftCMS two factor authentication plugin","description":"The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.","status":"published","published":"2024-06-06T12:30:36Z","modified":"2024-06-10T20:22:13Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-200","CWE-522"],"updated_at":"2026-11-02T14:37:54.624184Z"}],"nvd":[{"id":"CVE-2024-5657","description":"The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.","status":"published","published":"2024-06-06T11:15:49.277Z","modified":"2026-06-17T08:16:22.547Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-499","CWE-522"],"updated_at":"2026-11-02T14:10:04.111836Z"}],"osv":[{"id":"CVE-2024-5657","title":"CraftCMS Plugin - Two-Factor Authentication - Password Hash Disclosure","description":"The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.","status":"published","published":"2024-06-06T10:29:40.393Z","modified":"2026-10-28T02:30:40.109664322Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-499"],"updated_at":"2026-11-02T15:44:44.777182Z"},{"id":"GHSA-3p4x-grpm-xw58","title":"Password hash exposed in CraftCMS two factor authentication plugin","description":"The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.","status":"published","published":"2024-06-06T12:30:36Z","modified":"2024-06-10T20:40:45.895404Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-200","CWE-522"],"updated_at":"2026-11-02T15:46:35.747385Z"}]}}