Jumpserver Authorization Issues Vulnerability

Jumpserver is an open source bastion machine from Hangzhou Feizhiyun Information Technology Co. in China. JumpServer versions prior to 3.8.0 suffer from an authorization issue vulnerability that stems from an attacker being able to reset a password by sending an email...

CVE-2023-46138: Weak Password Recovery Mechanism for Forgotten Password

JumpServer is an open source bastion host and maintenance security audit system that complies with 4A specifications. Prior to version 3.8.0, the default email for initial user admin is [email protected], and users reset their passwords by sending an email. Currently, the domain mycompany.com h...

PT-2023-29870 · Unknown · Jumpserver

Name of the Vulnerable Software and Affected Versions: JumpServer versions prior to 3.8.0 Description: The issue concerns the default email address for the initial admin user, which is set to [email protected]. This could potentially affect password reset functionality if the domain mycompany.c...

CVE-2023-46123

jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specifications. A flaw in the Core API allows attackers to bypass password brute-force protections by spoofing arbitrary IP addresses. By exploiting this vulnerability,...

Design/Logic Flaw

jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specifications. A flaw in the Core API allows attackers to bypass password brute-force protections by spoofing arbitrary IP addresses. By exploiting this vulnerability,...

CVE-2023-46123

CVE-2023-46123 describes a bypass of password brute-force protections in JumpServer’s Core API by spoofing arbitrary IP addresses, enabling attackers to perform unlimited password attempts. Affected: JumpServer (open source bastion/O&M system) prior to version 3.8.0. Mitigation: patch applied in ...

CVE-2023-46123 jumpserver is vulnerable to password brute-force protection bypass via arbitrary IP values

jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specifications. A flaw in the Core API allows attackers to bypass password brute-force protections by spoofing arbitrary IP addresses. By exploiting this vulnerability,...

CVE-2023-46123 jumpserver is vulnerable to password brute-force protection bypass via arbitrary IP values

jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specifications. A flaw in the Core API allows attackers to bypass password brute-force protections by spoofing arbitrary IP addresses. By exploiting this vulnerability,...

CVE-2023-46123 jumpserver is vulnerable to password brute-force protection bypass via arbitrary IP values

jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specifications. A flaw in the Core API allows attackers to bypass password brute-force protections by spoofing arbitrary IP addresses. By exploiting this vulnerability,...

CVE-2023-46123: Improper Restriction of Excessive Authentication Attempts

jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specifications. A flaw in the Core API allows attackers to bypass password brute-force protections by spoofing arbitrary IP addresses. By exploiting this vulnerability,...

JumpServer Security Vulnerability

Jumpserver is an open source bastion machine from Hangzhou Feizhiyun Information Technology Co. in China. A security vulnerability exists in JumpServer versions prior to 3.8.0 that stems from allowing an attacker to bypass password brute force protection by spoofing arbitrary IP addresses...

GHSA-4R5X-X283-WM96 Jumpserver Koko vulnerable to remote code execution on the host system via MongoDB shell

Impact An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary commands, leading to remote code execution. This vulnerability may further be leveraged to gain root privileges on the host system. Details Through the WEB CLI interface provided by koko, a user logs...

Jumpserver Koko vulnerable to remote code execution on the host system via MongoDB shell

Impact An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary commands, leading to remote code execution. This vulnerability may further be leveraged to gain root privileges on the host system. Details Through the WEB CLI interface provided by koko, a user logs...

Exploit for Improper Authentication in Fit2Cloud Jumpserver

CVE-2023-42442 CVE-2023-42442 – JumpServer Session recording...

Exploit for Improper Authentication in Fit2Cloud Jumpserver

BlackJump Chinese |...

Exploit for Improper Authentication in Fit2Cloud Jumpserver

BlackJump Chinese |...

Exploit for Path Traversal in Fit2Cloud Jumpserver

CVE-2023-42819 CVE-2023-42819 Description of the Vulne...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Fit2Cloud Jumpserver

CVE-2023-42820 CVE-2023-42820 Vulnerability Description...

The vulnerability of the application software interface of the JumpServer system for auditing security operations and maintenance allows a perpetrator to bypass passwords.

The vulnerability of the application software interface of the JumpServer security audit system for operation and maintenance involves insufficient protection of operational data during the loading of external libraries. Exploiting this vulnerability allows a malicious actor to remotely reset...

The vulnerability of the application software interface of the JumpServer system for security audits, which allows a perpetrator to trigger a service failure.

The vulnerability of the application software interface of the JumpServer security audit system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to cause service failures...