Vulnerability CVE-2021-21329
Published: 2021-03-08

Description:
RATCF is an open-source framework for hosting Cyber-Security Capture the Flag events. In affected versions of RATCF users with multi factor authentication enabled are able to log in without a valid token. This is fixed in commit cebb67b.

Type:

CWE-287

 (Improper Authentication)

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.8/10
6.4/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Ratcf -> Ratcf 

 References:
https://github.com/ractf/core/commit/c57a4d186bfc586ad3edfe4dcba9f11efbf22f09#diff-60c444c47c061306f2dff5bf97c07810f40f949a8e94ecbb609b6b29364c8642R130-R152
https://github.com/ractf/core/commit/cebb67bd16a8296121201805332365ffccb29638
https://github.com/ractf/core/security/advisories/GHSA-fw57-f7mq-9q85
Copyright 2024, cxsecurity.com

 

Back to Top