title: Multi Factor Authentication Token Improperly Validated On User Login
description: RATCF is an open-source framework for hosting Cyber-Security Capture the Flag events. In affected versions of RATCF users with multi factor authentication enabled are able to log in without a valid token. This is fixed in commit cebb67b.
problem types: CWE-287 Improper Authentication
affected:
{
product: core
vendor: ractf
versions:
status: affected, version: >c57a4d186bfc586ad3edfe4dcba9f11efbf22f09, < cebb67bd16a8296121201805332365ffccb29638
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
version: 3.1
]