CVE-2023-36816
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
2FA is a web application for managing Two-Factor Authentication (2FA) accounts and generating security codes. Cross site scripting (XSS) injection can be performed via the account/service field.
Risk Assessment
Exploitation of this vulnerability may lead to user data theft and account takeover. Organizations should be aware of the risks associated with unauthorized access to data.
Recommendation
It is recommended to upgrade to version 4.0.3, where this vulnerability has been patched. A security audit of the application should also be conducted.
Original NVD description (English source)
2FA is a Web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Cross site scripting (XSS) injection can be done via the account/service field. This was tested in docker-compose environment. This vulnerability has been patched in version 4.0.3.