Vulnerability Details CVE-2022-42731
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 36.9%
CVSS Severity
CVSS v3 Score 7.5
References
- https://github.com/mkalioby/django-mfa2/blob/0936ea253354dd95cb127f09d0efa31324caef27/mfa/FIDO2.py#L58
- https://github.com/mkalioby/django-mfa2/releases/tag/v2.5.1-release
- https://github.com/mkalioby/django-mfa2/releases/tag/v2.6.1-release
- https://github.com/mkalioby/django-mfa2/blob/0936ea253354dd95cb127f09d0efa31324caef27/mfa/FIDO2.py#L58
- https://github.com/mkalioby/django-mfa2/releases/tag/v2.5.1-release
- https://github.com/mkalioby/django-mfa2/releases/tag/v2.6.1-release
Products affected by CVE-2022-42731
-
cpe:2.3:a:django-mfa2_project:django-mfa2:-
-
cpe:2.3:a:django-mfa2_project:django-mfa2:1.0.4
-
cpe:2.3:a:django-mfa2_project:django-mfa2:1.1
-
cpe:2.3:a:django-mfa2_project:django-mfa2:1.1.6
-
cpe:2.3:a:django-mfa2_project:django-mfa2:1.3
-
cpe:2.3:a:django-mfa2_project:django-mfa2:1.6
-
cpe:2.3:a:django-mfa2_project:django-mfa2:1.7.11
-
cpe:2.3:a:django-mfa2_project:django-mfa2:1.9
-
cpe:2.3:a:django-mfa2_project:django-mfa2:2.0
-
cpe:2.3:a:django-mfa2_project:django-mfa2:2.0.1
-
cpe:2.3:a:django-mfa2_project:django-mfa2:2.0.3
-
cpe:2.3:a:django-mfa2_project:django-mfa2:2.0.5
-
cpe:2.3:a:django-mfa2_project:django-mfa2:2.1.0
-
cpe:2.3:a:django-mfa2_project:django-mfa2:2.2.0
-
cpe:2.3:a:django-mfa2_project:django-mfa2:2.3.0
-
cpe:2.3:a:django-mfa2_project:django-mfa2:2.4.0
-
cpe:2.3:a:django-mfa2_project:django-mfa2:2.5
-
cpe:2.3:a:django-mfa2_project:django-mfa2:2.6.0