Medium severity · published Nov 8, 2023
CVE-2023-45140
The Bastion provides authentication, authorization, traceability and auditability for SSH accesses
4.6
CVSS
0.4%
EPSS
No
On KEV
Description
The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-based JIT MFA. Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not ask for additional factor. This abnormal behavior only applies to per-group-based JIT MFA. Other MFA setup types, such as Immediate MFA, JIT MFA on a per-plugin basis and JIT MFA on a per-account basis are not affected. This issue has been patched in version 3.14.15.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TH
The-bastion · Ovh
before 3.14.15 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-45140
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-45140
Patch
https://github.com/ovh/the-bastion/releases/tag/v3.14.15
Mitigation
https://github.com/ovh/the-bastion/security/advisories/GHSA-pr4q-w883-pf5x
More from The-bastion
4.4
CVE-2025-59339
The Bastion ttyrec files are not signed after encryption by the osh-encrypt-rsync script