CVE-2024-41800

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials. This has been patched in Craft 5.2.3.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Jul 25, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-418016.1OpenProject is open source project management software. Prior to version 14.3.0, using a forged HOST header in the default configuration of CVE-2024-418028.1Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Fi CVE-2024-418034.9Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Fi CVE-2024-418046.5Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API route inside the CMS responsible for Add CVE-2024-418056.1Tracks, a Getting Things Done (GTD) web application, is vulnerable to reflected cross-site scripting in versions prior to 2.7.1. Reflected c CVE-2024-418065.3The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts i CVE-2024-418085.4The OpenObserve open-source observability platform provides the ability to filter logs in a dashboard by the values uploaded in a given log.CVE-2024-418096.1OpenObserve is an open-source observability platform. Starting in version 0.4.4 and prior to version 0.10.0, OpenObserve contains a cross-si CVE-2024-41818.8A command injection vulnerability exists in the RunGptLLM class of the llama_index library, version 0.9.47, used by the RunGpt framework fro CVE-2024-418106.1Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains a CVE-2024-418113.9ipl/web is a set of common web components for php projects. Some of the recent development by Icinga is, under certain circumstances, suscep CVE-2024-418127.5txtdot is an HTTP proxy that parses only text, links, and pictures from pages, removing ads and heavy scripts. Prior to version 1.7.0, a Ser