Really Simple SSL exposed a two-factor reset path on the user profile form that only checked a nonce, not whether the user was permitted to turn their second factor off. A user who was required to use two-factor authentication could submit a crafted profile update that deleted their own 2FA metadata, resetting the mandatory-2FA grace period and... Weiterlesen
Intelligence View
⚡ tsecurity.de Intelligence
Missing Authorization in Really Simple SSL Two-Factor Profile Settings
Really Simple SSL exposed a two-factor reset path on the user profile form that only checked a nonce, not whether the user was permitted to turn their second factor off. A user who was required to use two-factor authentication could submit…
Reagiere als Erste:r — dein Feedback zählt!
SOCIAL SHARE CARD GENERATOR