CVE-2023-42819

🗓️ 26 Sep 2023 20:40:41Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 2500 Views🌐 WEB

JumpServer is an open source bastion host with a directory traversal flaw allowing unauthorized file access and modification

Reporter	Title	Published	Views	Family All 11
GithubExploit	Exploit for Path Traversal in Fit2Cloud Jumpserver	12 Oct 202308:45	–	githubexploit
BDU FSTEC	The vulnerability of the JumpServer security audit system arises from incorrect restrictions on the path to the restricted access catalog. This allows attackers to gain unauthorized access to protected information and modify the contents of arbitrary files within the system.	22 Nov 202300:00	–	bdu_fstec
Circl	CVE-2023-42819	12 Oct 202308:59	–	circl
CNNVD	Jumpserver Path Traversal Vulnerability	27 Sep 202300:00	–	cnnvd
Cvelist	CVE-2023-42819 Path traversal in Jumpserver	26 Sep 202320:40	–	cvelist
NVD	CVE-2023-42819	27 Sep 202315:19	–	nvd
OSV	CVE-2023-42819 Path traversal in Jumpserver	26 Sep 202320:40	–	osv
Prion	Directory traversal	27 Sep 202315:19	–	prion
Positive Technologies	PT-2023-7007 · Unknown · Jumpserver	26 Sep 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-42819	23 May 202502:01	–	redhatcve

NVD

Vulners

Node

fit2cloud jumpserverRange3.0.0–3.6.5

[
  {
    "vendor": "jumpserver",
    "product": "jumpserver",
    "versions": [
      {
        "version": ">= 3.0.0, < 3.6.5",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/jumpserver/jumpserver/commit/d0321a74f1713d031560341c8fd0a1859e6510d8
github	www.github.com/jumpserver/jumpserver/security/advisories/GHSA-ghg2-2whp-6m33

Parameter	Position	Path	Description	CWE
key	query param	/api/v1/ops/playbook/e0adabef-c38f-492d-bd92-832bacc3df5f/file/?key=../../../../../../../etc/passwd	Directory traversal vulnerability exposing arbitrary file contents via playbook file endpoint	CWE-22

17 Jun 2026 06:24Current

8.6High risk

Vulners AI Score8.6

CVSS 3.18.8 - 8.9

EPSS0.01856

SSVC

CWE-22