« Volver al listado

CVE-2026-3214

Estado: AnalizadaMedia (6.5)—

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass.This issue affects CAPTCHA: from 0.0.0 before 1.17.0, from 2.0.0 before 2.0.10.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Arnabdotorg — Captcha

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-3214",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-3214",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-26T13:44:20.728731Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "mlhess@drupal.org",
      "affectedData": [
        {
          "repo": "https://git.drupalcode.org/project/captcha",
          "vendor": "Drupal",
          "product": "CAPTCHA",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "1.17.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "2.0.0",
              "lessThan": "2.0.10",
              "versionType": "semver"
            }
          ],
          "collectionURL": "https://www.drupal.org/project/captcha",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-03-25T16:16:22.490",
  "references": [
    {
      "url": "https://www.drupal.org/sa-contrib-2026-015",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "mlhess@drupal.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "mlhess@drupal.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-288"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass.This issue affects CAPTCHA: from 0.0.0 before 1.17.0, from 2.0.0 before 2.0.10."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de omisión de autenticación usando una ruta o canal alternativo en Drupal CAPTCHA permite la omisión de funcionalidad. Este problema afecta a CAPTCHA: desde 0.0.0 antes de 1.17.0, desde 2.0.0 antes de 2.0.10."
    }
  ],
  "lastModified": "2026-06-17T10:43:13.527",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:arnabdotorg:captcha:*:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1E80D35D-CC93-4EE7-BF90-D228FFA6C642",
              "versionEndExcluding": "8.x-1.17"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:arnabdotorg:captcha:*:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "467B3608-A978-494B-A32B-0662D997FEFC",
              "versionEndExcluding": "2.0.10",
              "versionStartIncluding": "2.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "mlhess@drupal.org"
}