PT-2025-21197 · Drupal · Enterprise Mfa - Tfa For Drupal

Juraj Nemec

+1

·

CVE-2025-47709

·

Published

2025-05-07

·

Updated

2025-06-10

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions: Enterprise MFA - TFA for Drupal versions 0.0.0 through 4.6.x Enterprise MFA - TFA for Drupal versions 5.0.0 through 5.1.x
Description: The issue is related to a Missing Authorization vulnerability in Enterprise MFA - TFA for Drupal, which allows Forceful Browsing.
Recommendations: For versions 0.0.0 through 4.6.x, update to version 4.7.0 or later. For versions 5.0.0 through 5.1.x, update to version 5.2.0 or later.

Exploit

Fix

Missing Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-47709
DRUPAL-CONTRIB-2025-055

Affected Products

Enterprise Mfa - Tfa For Drupal