CVE-2023-43650

creationtimestamp| type| source ---|---|--- 2023-09-27 22:36:17+00:00| seen| https://t.me/cibsecurity/71152 2024-01-04 06:27:49+00:00| seen| https://t.me/arpsyndicate/2444...

CVE-2023-43650 Non-MFA account takeover via brute-force attack on weak password reset code in jumpserver

JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to the absence of rate limiting. JumpServer provides a feature allowing users to reset forgotten passwords. Affected users are sent a 6-digit verification code,...

CVE-2023-43650

CVE-2023-43650 affects JumpServer and describes an authentication issue where the verification code used for password resets is not rate-limited, enabling brute-force attempts. The 6-digit code (000000–999999) is sent for password reset and can be targeted within a 1-minute window, potentially al...