CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NCVE-2023-45292
Medium (5.3) in mojotv base64captcha. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/mojocn/base64Captcha 1.3.6.
When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 22% of CVEs (scores of 2026-10-31)
- CWE
- CWE-345
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mojotv:base64captcha
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-5mmw-p5qv-w3x5 | Go | github.com/mojocn/base64Captcha | <1.3.6 | 1.3.6 |
| GO-2023-2386 | Go | github.com/mojocn/base64Captcha | <1.3.6 | 1.3.6 |
References
- https://github.com/mojocn/base64Captcha/commit/5ab86bd6f333aad3936f912fc52b411168dcd4a7
- https://github.com/mojocn/base64Captcha/commit/9b11012caca58925f1e47c770f79f2fa47e3ad13
- https://github.com/mojocn/base64Captcha/issues/120
- https://pkg.go.dev/vuln/GO-2023-2386
- https://github.com/mojocn/base64Captcha/commit/5ab86bd6f333aad3936f912fc52b411168dcd4a7