CVE-2024-5657

Name of the Vulnerable Software and Affected Versions CraftCMS plugin Two-Factor Authentication versions 3.3.1 through 3.3.3

Description The issue discloses the password hash of the currently authenticated user after submitting a valid TOTP.

Recommendations For versions 3.3.1 through 3.3.3, consider disabling the Two-Factor Authentication plugin until a patch is available to prevent the disclosure of password hashes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.