CVE-2024-41800

Craft CMS Allows TOTP Token To Stay Valid After Use

Description

Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials. This has been patched in Craft 5.2.3.

Category

4.8
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.07%
Vendor Advisory github.com
Affected: craftcms cms
Published at:
Updated at:

References

Link Tags
https://github.com/craftcms/cms/security/advisories/GHSA-wmx7-pw49-88jx vendor advisory
https://github.com/craftcms/cms/commit/7c790fa5ad5a8cb8016cb6793ec3554c4c079e38 patch
https://github.com/craftcms/cms/releases/tag/5.2.3 release notes
https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240617-01_CraftCMS_TOTP_Valid_After_Use third party advisory

Frequently Asked Questions

What is the severity of CVE-2024-41800?
CVE-2024-41800 has been scored as a medium severity vulnerability.
How to fix CVE-2024-41800?
To fix CVE-2024-41800, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-41800 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2024-41800 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-41800?
CVE-2024-41800 affects craftcms cms.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.