CVE-2024-48942

Medium

The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to easily brute-force the…

mitre·NVD-CWE-noinfo·Published 2024-10-09

CVSS

5.9

EPSS

0.00

KEV

Exploits

cve.orgen

258 chars

The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to easily brute-force the 2FA PIN via the plugins/servlet/twofactor/public/pinvalidation endpoint. The last 30 and the next 30 tokens are valid.

NVDen

258 chars

NVDes

312 chars

El complemento Syracom Secure Login (2FA) para Jira, Confluence y Bitbucket hasta la versión 3.1.4.5 permite a atacantes remotos acceder fácilmente por fuerza bruta al PIN de 2FA a través del punto de conexión plugins/servlet/twofactor/public/pinvalidation. Los últimos 30 tokens y los siguientes 30 son válidos.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	cve.org	9.1	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
3.1	Primary	cve.org	9.1	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
3.1	Primary	NVD	5.9	2.2	3.6	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
3.1	Secondary	NVD	9.1	3.9	5.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N