CVE-2023-42820: JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated…

PriorityP352high8.2CVSS 3.1

AVNACLPRNUINSUCLIHAN

EPSS

5.40%

91.7th percentile

JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated verification codes to be replayed, which could lead to password resets. If MFA is enabled users are not affect. Users not using local authentication are also not affected. Users are advised to upgrade to either version 2.28.19 or to 3.6.5. There are no known workarounds or this issue.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
fit2cloud	jumpserver	>= 2.24.0 < 2.28.19	2.28.19
fit2cloud	jumpserver	>= 3.0.0 < 3.6.5	3.6.5
jumpserver	jumpserver	—	—
jumpserver	jumpserver	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.