CVE-2023-22958

Summary

The Syracom Secure Login plugin before 3.1.1.0 for Jira may allow spoofing of 2FA PIN validation via the plugins/servlet/twofactor/public/pinvalidation target parameter.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/piuppi/Proof-of-Concepts/blob/main/Syracom/SecureLogin2FA-OpenRedirect.md

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/piuppi/Proof-of-Concepts/blob/main/Syracom/SecureLogin2FA-OpenRedirect.md

• ←Previous
• Next→