CVE-2024-13239
EPSS 0.54%
Description
This module enables you to allow and/or require users to use a second authentication method in addition to password authentication. In some cases, the module allows users to log in with an authentication plugin that an administrator has disabled. This vulnerability is mitigated by the fact that an attacker must obtain a valid first-factor login credential, that an administrator must enable and then disable an authentication plugin, and that an attacker must obtain the valid second factor credential for the disabled plugin.
How to fix CVE-2024-13239
To remediate CVE-2024-13239, upgrade the affected package to a fixed version below.
- —upgrade to 1.5.0 or later
Is CVE-2024-13239 being exploited?
Low — EPSS is 0.5%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 1.5.0