CVE-2024-48942

—

CVSS 3.1

5.9 medium

EPSS

<1%p38

Published

Oct 10, 2024 (Oct 10, 2024)

Modified

Jun 17, 2026

Description

The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to easily brute-force the 2FA PIN via the plugins/servlet/twofactor/public/pinvalidation endpoint. The last 30 and the next 30 tokens are valid.

Vendors: syracom
Products: secure login
Weakness: CWE-799
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.