CVE-2023-28110

2023-03-1617:15:09

Google

osv.dev

jumpserver

koko

ssh service

sftp service

kubernetes cluster

vulnerability

illegal tokens

dangerous commands

security

fix

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.2%

JSON

Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco’s SSH/SFTP service and Web Terminal service. Prior to version 2.28.8, using illegal tokens to connect to a Kubernetes cluster through Koko can result in the execution of dangerous commands that may disrupt the Koko container environment and affect normal usage. The vulnerability has been fixed in v2.28.8.