CVE-2022-28601

A Two-Factor Authentication (2FA) bypass vulnerability in "Simple 2FA Plugin for Moodle" by LMS Doctor allows remote attackers to overwrite the phone number used for confirmation via the profile.php file. Therefore, allowing them to bypass the phone verification mechanism.

CVSS v3.1 NVD

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CVSS v2.0 NVD

4.0 MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N

EPSS

1.74% chance of exploitation in the next 30 days, 77th percentile

Published

2022-05-10

Updated

2024-08-03

Proof-of-concept exploits (1)

• FlaviuPopescu/CVE-2022-286018★ · 2022-05-09

Security advisories

• https://www.lmsdoctor.com/simple-2-factor-authentication-plugin-for-moodle

References

• CVE Record
• NVD entry

Related

• CVE-2021-38095
• CVE-2022-28986