PT-2024-33288 · Atlassian+1 · Confluence+3

Christian Flaßkamp · Published 2024-10-09 · Updated 2024-10-11 · CVE-2024-48942

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket versions 3.1.4.5 and earlier

Description The issue allows remote attackers to easily brute-force the 2FA PIN via the "plugins/servlet/twofactor/public/pinvalidation" endpoint. The last 30 and the next 30 tokens are valid.

Recommendations For versions 3.1.4.5 and earlier, as a temporary workaround, consider restricting access to the "plugins/servlet/twofactor/public/pinvalidation" endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-799

Related Identifiers

CVE-2024-48942

Affected Products

Bitbucket

Confluence

Jira

Syracom Secure Login

References · 7

• https://osv.dev/vulnerability/CVE-2024-48942 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-48942 · Security Note
• https://syracom-bee.atlassian.net/wiki/spaces/SL/pages/3236560898/2024-09-16+-+Secure+Login+security+advisory+-+Insecure+default+configuration · Vendor Advisory
• https://twitter.com/CVEnew/status/1844160554488779013 · Twitter Post
• https://t.me/cvenotify/97702 · Telegram Post
• https://t.me/cvenotify/97899 · Telegram Post
• https://t.me/cvedetector/7539 · Telegram Post