GitHub_MCVELIST:CVE-2023-28110CVE-2023-28110 JumpServer Koko vulnerable to Command Injection for Kubernetes Connection
5.7 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H
9.7 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
36.2%
Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco’s SSH/SFTP service and Web Terminal service. Prior to version 2.28.8, using illegal tokens to connect to a Kubernetes cluster through Koko can result in the execution of dangerous commands that may disrupt the Koko container environment and affect normal usage. The vulnerability has been fixed in v2.28.8.
CNA Affected
[
{
"vendor": "jumpserver",
"product": "jumpserver",
"versions": [
{
"version": "< 2.28.8",
"status": "affected"
}
]
}
]Related
5.7 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H
9.7 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
36.2%