« Volver al listado

CVE-2025-47709

Estado: AnalizadaMedia (6.5)—

Missing Authorization vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Forceful Browsing.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Miniorange — Miniorange 2FA

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-47709",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-47709",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-19T14:28:51.253078Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "mlhess@drupal.org",
      "affectedData": [
        {
          "repo": "https://git.drupalcode.org/project/miniorange_2fa",
          "vendor": "Drupal",
          "product": "Enterprise MFA - TFA for Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "4.7.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.0.0",
              "lessThan": "5.2.0",
              "versionType": "semver"
            }
          ],
          "collectionURL": "https://www.drupal.org/project/miniorange_2fa",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-05-14T17:15:50.217",
  "references": [
    {
      "url": "https://www.drupal.org/sa-contrib-2025-055",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "mlhess@drupal.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "mlhess@drupal.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Missing Authorization vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Forceful Browsing.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de autorización faltante en Drupal Enterprise MFA - TFA para Drupal permite la navegación forzada. Este problema afecta a Enterprise MFA - TFA para Drupal: desde la versión 0.0.0 hasta la 4.7.0 y desde la versión 5.0.0 hasta la 5.2.0."
    }
  ],
  "lastModified": "2026-06-17T09:28:35.680",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:miniorange:miniorange_2fa:*:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BA9E952B-E79E-4637-BDDD-57FA9EE7BA22",
              "versionEndExcluding": "5.2.0",
              "versionStartIncluding": "5.0.0"
            },
            {
              "criteria": "cpe:2.3:a:miniorange:miniorange_2fa:*:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8EE065DA-973F-44D4-BFF5-E3A90B619330",
              "versionEndExcluding": "8.x-4.7",
              "versionStartIncluding": "7.x-2.16"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "mlhess@drupal.org"
}