PoC Index

CVE-2022-28601

MEDIUM 6.5EPSS 1.7%

A Two-Factor Authentication (2FA) bypass vulnerability in "Simple 2FA Plugin for Moodle" by LMS Doctor allows remote attackers to overwrite the phone number used for confirmation via the profile.php file. Therefore, allowing them to bypass the phone verification mechanism.

CVSS v3.1
6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v2.0
4.0 MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N
EPSS
1.71% chance of exploitation in the next 30 days, 76th percentile
Published
2022-05-10
Updated
2024-08-03

Proof-of-concept exploits (1)

References

Related