The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| born05/craft-twofactorauthentication(Packagist) | 3.3.1 | 3.3.4 | N/A |
CVSS Metrics
