CVE-2023-22958

CVE-2023-22958 concerns the Syracom Secure Login plugin for Jira, prior to version 3.1.1.0. The issue allows spoofing of 2FA PIN validation via the plugins/servlet/twofactor/public/pinvalidation target parameter, potentially enabling unauthorized access by bypassing two-factor authentication. Doc...

CVE-2024-48942

The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket (versions 3.1.4.5 and earlier ) is vulnerable to a brute-force attack against the 2FA PIN. The root cause is that the plugins/servlet/twofactor/public/pinvalidation endpoint accepts the last 30 and next 30 tokens as valid, ...

CVE-2024-48941

The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket (versions through 3.1.4.5 ) contains a vulnerability that allows remote attackers to bypass two-factor authentication (2FA) . The root cause is an insecure default configuration where the /rest endpoint is allowlisted, enab...