CVE-2024-48941

5.4 mediumEPSS 0.3%

Medium (5.4) in syracom secure login. EPSS 0.3% chance of exploitation in the next 30 days.

The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to bypass 2FA by interacting with the /rest endpoint of Jira, Confluence, or Bitbucket. In the default configuration, /rest is allowlisted.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 27% of CVEs (scores of 2026-10-31)
CWE: CWE-266
Published: 2024-10-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

syracom:secure_login

References

https://syracom-bee.atlassian.net/wiki/spaces/SL/pages/3236560898/2024-09-16+-+Secure+Login+security+advisory+-+Insecure+default+configuration

Check your stack JSON