Lucene search

K
osvGoogleOSV:GO-2023-2386
HistoryDec 08, 2023 - 8:11 p.m.

Captcha verification bypass in github.com/mojocn/base64Captcha

2023-12-0820:11:50
Google
osv.dev
8
github
captcha
verification
bypass
default implementation
verify
mojocn/base64captcha
software

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

20.6%

When using the default implementation of Verify to check a Captcha, verification can be bypassed.

For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct.

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

20.6%

Related for OSV:GO-2023-2386