CVE-2013-0258 The Google Authenticator login (ga_login) module 7.x before 7.x-1.3 for Drupal, when multi-factor authentication is enabled, allows remote attackers to bypass authentication for accounts without an as...
MediumCVSS 6.8
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Google Authenticator login (ga_login) module 7.x before 7.x-1.3 for Drupal, when multi-factor authentication is enabled, allows remote attackers to bypass authentication for accounts without an associated Google Authenticator token by logging in with the username.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| google authenticator login project ga login | = 7.x-1.0 | No fix listed |
| google authenticator login project ga login | = 7.x-1.0-beta1 | No fix listed |
| google authenticator login project ga login | = 7.x-1.0-dev | No fix listed |
| google authenticator login project ga login | = 7.x-1.1 | No fix listed |
| google authenticator login project ga login | = 7.x-1.2 | No fix listed |
References
- drupal.org patch
- drupal.org patch vendor-advisory
- drupalcode.org patch
- [oss-security] 20130204 Re: CVE request for Drupal contributed modules mailing-list