« Volver al listado

CVE-2025-47706

Estado: AnalizadaMedia (4.8)—

Authentication Bypass by Capture-replay vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Remote Services with Stolen Credentials.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Miniorange — Miniorange 2FA

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-47706",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-47706",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-19T14:26:27.918933Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "mlhess@drupal.org",
      "affectedData": [
        {
          "repo": "https://git.drupalcode.org/project/miniorange_2fa",
          "vendor": "Drupal",
          "product": "Enterprise MFA - TFA for Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "4.7.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.0.0",
              "lessThan": "5.2.0",
              "versionType": "semver"
            }
          ],
          "collectionURL": "https://www.drupal.org/project/miniorange_2fa",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-05-14T17:15:49.837",
  "references": [
    {
      "url": "https://www.drupal.org/sa-contrib-2025-052",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "mlhess@drupal.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "mlhess@drupal.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-294"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Authentication Bypass by Capture-replay vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Remote Services with Stolen Credentials.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de omisión de autenticación por captura y repetición en Drupal Enterprise MFA - TFA para Drupal permite servicios remotos con credenciales robadas. Este problema afecta a Enterprise MFA - TFA para Drupal: desde la versión 0.0.0 hasta la 4.7.0 y desde la versión 5.0.0 hasta la 5.2.0."
    }
  ],
  "lastModified": "2026-06-17T09:28:35.260",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:miniorange:miniorange_2fa:*:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BA9E952B-E79E-4637-BDDD-57FA9EE7BA22",
              "versionEndExcluding": "5.2.0",
              "versionStartIncluding": "5.0.0"
            },
            {
              "criteria": "cpe:2.3:a:miniorange:miniorange_2fa:*:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8EE065DA-973F-44D4-BFF5-E3A90B619330",
              "versionEndExcluding": "8.x-4.7",
              "versionStartIncluding": "7.x-2.16"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "mlhess@drupal.org"
}