CVE-2023-45140

MOYENNE 4.6CVE-2023-45140 · Published 08/11/2023 · updated 17/06/2026

En bref

CVE-2023-45140 est une vulnérabilité MOYENNE (CVSS 4.6) touchant the-bastion (ovh).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.39%, plus élevée que 33.0% des vulnérabilités.
Correctif : mettre à jour vers 3.14.15 ou plus récent.

Package	Affected versions	Patched versions
the-bastion ovh	`< 3.14.15`	`3.14.15`

Description

The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-based JIT MFA. Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not ask for additional factor. This abnormal behavior only applies to per-group-based JIT MFA. Other MFA setup types, such as Immediate MFA, JIT MFA on a per-plugin basis and JIT MFA on a per-account basis are not affected. This issue has been patched in version 3.14.15.

References

ovh/the-bastion release v3.14.15 · Patch
ovh/the-bastion security advisory · Mitigation

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free