CVE-2023-45140
CVSS 3.1 Score 4.6 of 10 (medium)
Details
Summary
CVE-2023-45140 affects The Bastion, an SSH access management solution. The vulnerability lies in the SCP and SFTP plugins, which fail to enforce Multi-Factor Authentication (MFA) for group-based Just-In-Time (JIT) access. Establishing a connection through The Bastion using a group access that enforces MFA will not prompt for an additional factor. However, this issue is limited to per-group-JIT MFA, and other MFA setups, including Immediate MFA and JIT MFA on a per-plugin or per-account basis, remain unaffected. This vulnerability has been resolved in version 3.14.15.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.