Description (CNA)
nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| lucasdillmann / nginx-ignition | affected >= 2.33.0, < 2.35.1 |
CWE
CWE-287
References
- https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-hf33-q6cf-c66f
- https://github.com/lucasdillmann/nginx-ignition/commit/1cbfae0296f1b186158f5a294ec484060e00102e
- https://github.com/lucasdillmann/nginx-ignition/commit/8d35e1eb5dd6a40fef94a45511fe08b0603af107
ADP enrichment
No English description supplied.
No references supplied.