PT-2016-4496
CVE-2016-1000032
·
Published
2016-10-25
·
Updated
2017-01-19
Description by
CVSS 3.1
7.5
HighMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions
TGCaptcha2 version 0.3.0
Description
The issue is related to a missing nonce, which enables attackers to reuse a single solved CAPTCHA multiple times, effectively bypassing the CAPTCHA's security mechanism.
Recommendations
For TGCaptcha2 version 0.3.0, consider implementing a nonce to prevent replay attacks until a patch is available. As a temporary workaround, restrict the use of the CAPTCHA mechanism to minimize the risk of exploitation.
Found an issue in the description? Have something to add? Feel free to write us 👾