CVE-2023-45140CWE-306

Group-based JIT MFA bypass on scp and sftp in The Bastion

Medium · published November 8, 2023

CVSS v3.1
4.8
EPSS
0%
Percentile
31.6
In the wild
Unconfirmed
What it is

The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-based JIT MFA. Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not ask for additional factor. This abnormal behavior only applies to per-group-based JIT MFA. Other MFA setup types, such as Immediate MFA, JIT MFA on a per-plugin basis and JIT MFA on a per-account basis are not affected. This issue has been patched in version 3.14.15.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00387 · 31.6th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2023-11-08T15:26Z
EPSS history
Timeline
  • 08 NOV 15:26Z
    Group-based JIT MFA bypass on scp and sftp in The Bastion
    cvelistv5