CVE-2013-0258

The Google Authenticator login (ga_login) module 7.x before 7.x-1.3 for Drupal, when multi-factor authentication is enabled, allows remote attackers to bypass authentication for accounts without an associated Google Authenticator token by logging in with the username.

Score

CVSS 2.0 6.8 Medium

Status

Modified - secalert@redhat.com

Published

2013-03-27

Last modified

2024-09-16

Weaknesses

CWE-287

Affected products

• Ga Login (Google Authenticator Login Project)

References

• http://drupal.org/node/1902102
• http://drupal.org/node/1903282
• http://drupalcode.org/project/ga_login.git/commitdiff/50b032d
• http://www.openwall.com/lists/oss-security/2013/02/05/1