CVE-2019-1020002: Pterodactyl vulnerable to 2FA Sniffing
7.5
CVSS Score
3.0
Basic Information
CVE ID
GHSA ID
EPSS Score
0.54157%
CWE
Published
5/24/2022
Updated
2/1/2023
KEV Status
No
Technology
PHP
Technical Details
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
pterodactyl/panel | composer | <= 0.7.13 | 0.7.14 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems from a logical flaw in the authentication flow (checking 2FA status before validating credentials), but the provided code diffs and files focus on 2FA secret generation and QR code handling rather than the authentication sequence itself. The actual vulnerable login controller logic that caused the observable discrepancy isn't shown in the provided patches. The modified TwoFactorSetupService
and SecurityController
functions relate to 2FA setup mechanics, not the flawed authentication order that allowed account enumeration. Without seeing the pre-patch login handler code that performed 2FA checks before password validation, we cannot confidently identify specific vulnerable functions from the provided data.