CVE-2024-5658

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-303CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Jun 6, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-565805.5In the Linux kernel, the following vulnerability has been resolved: media: qcom: camss: fix error path on configuration of power domains TCVE-2024-565817.8In the Linux kernel, the following vulnerability has been resolved: btrfs: ref-verify: fix use-after-free after invalid ref action At btrfCVE-2024-565827.8In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free in btrfs_encoded_read_endio() Shinichiro repCVE-2024-565835.5In the Linux kernel, the following vulnerability has been resolved: sched/deadline: Fix warning in migrate_enable for boosted tasks When rCVE-2024-565845.5In the Linux kernel, the following vulnerability has been resolved: io_uring/tctx: work around xa_store() allocation error issue syzbot trCVE-2024-565855.5In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix sleeping in atomic context for PREEMPT_RT Commit bab1c2CVE-2024-565865.5In the Linux kernel, the following vulnerability has been resolved: f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inodCVE-2024-565875.5In the Linux kernel, the following vulnerability has been resolved: leds: class: Protect brightness_show() with led_cdev->led_access mutex CVE-2024-565885.5In the Linux kernel, the following vulnerability has been resolved: scsi: hisi_sas: Create all dump files during debugfs initialization FoCVE-2024-565895.5In the Linux kernel, the following vulnerability has been resolved: scsi: hisi_sas: Add cond_resched() for no forced preemption model For CVE-2024-56596.5Rockwell Automation was made aware of a vulnerability that causes all affected controllers on the same network to result in a major nonrecovCVE-2024-565905.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet
CVE-2024-5658: Medium severity, CVSS 6.5 | Vulnix