CVE-2023-42819

2023-09-2715:19:33

CWE-22

[email protected]

web.nvd.nist.gov

2411

jumpserver

open source

bastion host

cve-2023-42819

directory traversal

unauthorized access

unauthorized modification

security vulnerability

8.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

8.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.8%

JSON

JumpServer is an open source bastion host. Logged-in users can access and modify the contents of any file on the system. A user can use the ‘Job-Template’ menu and create a playbook named ‘test’. Get the playbook id from the detail page, like ‘e0adabef-c38f-492d-bd92-832bacc3df5f’. An attacker can exploit the directory traversal flaw using the provided URL to access and retrieve the contents of the file. https://jumpserver-ip/api/v1/ops/playbook/e0adabef-c38f-492d-bd92-832bacc3df5f/file/?key=../../../../../../../etc/passwd a similar method to modify the file content is also present. This issue has been addressed in version 3.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected configurations

Vulners

NVD

Node

jumpserverjumpserverRange3.0.0–3.6.5

VendorProductVersionCPE
jumpserverjumpserver*cpe:2.3:a:jumpserver:jumpserver:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
jumpserver	jumpserver	*	cpe:2.3:a:jumpserver:jumpserver::::::::

CNA Affected

[
  {
    "vendor": "jumpserver",
    "product": "jumpserver",
    "versions": [
      {
        "version": ">= 3.0.0, < 3.6.5",
        "status": "affected"
      }
    ]
  }
]