CVE-2017-16634 : In Joomla! before 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication method.

In Joomla! before 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication method.

Published 2017-11-10 02:29:19

Updated 2017-11-28 17:20:58

Source MITRE

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Exploit prediction scoring system (EPSS) score for CVE-2017-16634

EPSS FAQ

1.22%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 84 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-16634

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2017-16634

http://www.securitytracker.com/id/1039757

Joomla! Bugs Let Remote Users Obtain Potentially Sensitive Information and Bypass Two-Factor Authentication - SecurityTracker
Third Party Advisory;VDB Entry

CVEs referencing this url
https://developer.joomla.org/security-centre/713-20171102-core-2-factor-authentication-bypass

[20171102] - Core - 2-factor-authentication bypass
Patch;Vendor Advisory
http://www.securityfocus.com/bid/101701

Joomla! CVE-2017-16634 Security Bypass Vulnerability
Third Party Advisory;VDB Entry

Products affected by CVE-2017-16634

Joomla » Joomla!
Versions from including (>=) 3.2.0 and up to, including, (<=) 3.8.1
cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*
Matching versions