CVE-2025-47708 - Vulnerability Details - OpenCVE

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Cross Site Request Forgery.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Miniorange	Miniorange 2fa

Configuration 1 [-]

OR	cpe:2.3:a:miniorange:miniorange_2fa::::::drupal::*
	cpe:2.3:a:miniorange:miniorange_2fa::::::drupal::*

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2025-054

History

Tue, 10 Jun 2025 15:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Miniorange Miniorange miniorange 2fa
CPEs		cpe:2.3:a:miniorange:miniorange_2fa::::::drupal::*
Vendors & Products		Miniorange Miniorange miniorange 2fa

Tue, 20 May 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 14 May 2025 17:15:00 +0000

Type	Values Removed	Values Added
Description		Cross-Site Request Forgery (CSRF) vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Cross Site Request Forgery.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.
Title		Enterprise MFA - TFA for Drupal - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-054
Weaknesses		CWE-352
References		https://www.drupal.org/sa-contrib-2025-054

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2025-05-14T17:03:14.838Z

Updated: 2025-05-20T16:17:25.732Z

Reserved: 2025-05-07T16:02:44.265Z

Link: CVE-2025-47708

Vulnrichment

Updated: 2025-05-15T13:55:57.144Z

NVD

Status : Analyzed

Published: 2025-05-14T17:15:50.083

Modified: 2025-06-10T15:25:51.580

Link: CVE-2025-47708

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-47708", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2025-05-07T16:02:44.265Z", "datePublished": "2025-05-14T17:03:14.838Z", "dateUpdated": "2025-05-20T16:17:25.732Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/miniorange_2fa", "defaultStatus": "unaffected", "product": "Enterprise MFA - TFA for Drupal", "repo": "https://git.drupalcode.org/project/miniorange_2fa", "vendor": "Drupal", "versions": [{"lessThan": "4.7.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}, {"lessThan": "5.2.0", "status": "affected", "version": "5.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Juraj Nemec (poker10)"}, {"lang": "en", "type": "remediation developer", "value": "Sudhanshu Dhage (sudhanshu0542)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "datePublic": "2025-05-07T17:07:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Cross Site Request Forgery.<p>This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.</p>"}], "value": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Cross Site Request Forgery.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0."}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "CAPEC-62 Cross Site Request Forgery"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-05-14T17:03:14.838Z"}, "references": [{"url": "https://www.drupal.org/sa-contrib-2025-054"}], "source": {"discovery": "UNKNOWN"}, "title": "Enterprise MFA - TFA for Drupal - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-054", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-05-20T15:42:53.200097Z", "id": "CVE-2025-47708", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-20T16:17:25.732Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-47708", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-05-20T15:42:53.200097Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-15T13:55:57.144Z"}}], "cna": {"title": "Enterprise MFA - TFA for Drupal - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-054", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Juraj Nemec (poker10)"}, {"lang": "en", "type": "remediation developer", "value": "Sudhanshu Dhage (sudhanshu0542)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "CAPEC-62 Cross Site Request Forgery"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/miniorange_2fa", "vendor": "Drupal", "product": "Enterprise MFA - TFA for Drupal", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "4.7.0", "versionType": "semver"}, {"status": "affected", "version": "5.0.0", "lessThan": "5.2.0", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/miniorange_2fa", "defaultStatus": "unaffected"}], "datePublic": "2025-05-07T17:07:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2025-054"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Cross Site Request Forgery.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.", "supportingMedia": [{"type": "text/html", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Cross Site Request Forgery.<p>This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-05-14T17:03:14.838Z"}}}, "cveMetadata": {"cveId": "CVE-2025-47708", "state": "PUBLISHED", "dateUpdated": "2025-05-20T16:17:25.732Z", "dateReserved": "2025-05-07T16:02:44.265Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2025-05-14T17:03:14.838Z", "assignerShortName": "drupal"}, "dataVersion": "5.1"}