#VU108904 Improper access control in Enterprise MFA - TFA for Drupal - CVE-2025-47706
Published: May 12, 2025
Vulnerability identifier: #VU108904
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2025-47706
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Enterprise MFA - TFA for Drupal
Enterprise MFA - TFA for Drupal
Software vendor:
gauravsood91
gauravsood91
Description
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to the affected module does not sufficiently check whether the TOTP token is already used or not for authenticator-based second-factor methods. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the application.
Remediation
Install updates from vendor's website.