CVE-2023-22958

CVE-2023-22958 concerns the Syracom Secure Login plugin for Jira, prior to version 3.1.1.0. The issue allows spoofing of 2FA PIN validation via the plugins/servlet/twofactor/public/pinvalidation target parameter, potentially enabling unauthorized access by bypassing two-factor authentication. Doc...

CVE-2024-48942

The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket (versions 3.1.4.5 and earlier) is affected. The vulnerability allows remote attackers to brute-force the 2FA PIN via the plugins/servlet/twofactor/public/pinvalidation endpoint, with the last 30 tokens and the next 30 token...

CVE-2024-48941

The CVE-2024-48941 entry concerns the Syracom Secure Login 2FA plugin for Jira, Confluence, and Bitbucket (affected version family up to 3.1.4.5). The root issue is a 2FA bypass achieved by interacting with the /rest endpoint; in default configurations, /rest is allowlisted, enabling potential by...