CVE-2024-13279

Published: Jan 9, 2025Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Session Fixation vulnerability in Drupal Two-factor Authentication (TFA) allows Session Fixation.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.8.0.

Affected (1)

Products: Two Factor Authentication Project: Two Factor Authentication

Two Factor Authentication Project

1 product

Two Factor Authentication

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Two Factor Authentication Project Two Factor Authentication	Before 8.x-1.8

Related CWEs

CWE-384

Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References (1)

https://www.drupal.org/sa-contrib-2024-043

Source: mlhess@drupal.org

Third Party Advisory

Timeline

No history available yet.