UpHeron
All vulnerabilities

Servers and applications

CVE-2024-41800

Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials. This has been patched in Craft 5.2.3.

Severity
High 7.5
Published
25 Jul 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
5.2.3
Sources
NVD

Affected software

SoftwareAffected versions
Craft CMSServers and applications · cpe:a:craftcms:craft_cms
  • From 5.0.1 before 5.2.3
  • Version 5.0.0-rc1
  • Version 5.0.0-beta11
  • Version 5.0.0-beta10
All 13 release lines
  • Version 5.0.0-beta1
  • Version 5.0.0-beta2
  • Version 5.0.0-beta3
  • Version 5.0.0-beta4
  • Version 5.0.0-beta5
  • Version 5.0.0-beta6
  • Version 5.0.0-beta7
  • Version 5.0.0-beta8
  • Version 5.0.0-beta9
  • Version 5.0.0-beta10
  • Version 5.0.0-beta11
  • Version 5.0.0-rc1
  • From 5.0.1 before 5.2.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-41800
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-41800