Fit2Cloud Jumpserver vulnerabilities

CVE-2023-42442 [MEDIUM] CWE-287 CVE-2023-42442: JumpServer is an open source bastion host and a professional operation and maintenance security audi JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not affected. The api `/api/v1/terminal/sessions/` permission

CVE-2023-43651 [CRITICAL] CWE-94 CVE-2023-43651: JumpServer is an open source bastion host. An authenticated user can exploit a vulnerability in Mong JumpServer is an open source bastion host. An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary commands, leading to remote code execution. This vulnerability may further be leveraged to gain root privileges on the system. Through the WEB CLI interface provided by the koko component, a user logs into the author

CVE-2024-40629 [CRITICAL] CWE-22 CVE-2024-40629: JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT tea JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the Ansible playbook to write arbitrary files, leading to remote code execution (RCE) in the Celery container

CVE-2024-29201 [CRITICAL] CWE-94 CVE-2024-29201: JumpServer is an open source bastion host and an operation and maintenance security audit system. At JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information

CVE-2024-29202 [CRITICAL] CWE-94 CVE-2024-29202: JumpServer is an open source bastion host and an operation and maintenance security audit system. At JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template injection vulnerability in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive

CVE-2023-42818 [CRITICAL] CWE-287 CVE-2023-42818: JumpServer is an open source bastion host. When users enable MFA and use a public key for authentica JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding SSH private key. An attacker could exploit a vulnerability by utilizing a disclosed public key to attempt brute-force authentication against the SSH service This issue has been patched in v

CVE-2024-40628 [CRITICAL] CWE-22 CVE-2024-40628: JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT tea JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the ansible playbook to read arbitrary files in the celery container, leading to sensitive information disclo

CVE-2023-43652 [CRITICAL] CWE-862 CVE-2023-43652: JumpServer is an open source bastion host. As an unauthenticated user, it is possible to authenticat JumpServer is an open source bastion host. As an unauthenticated user, it is possible to authenticate to the core API with a username and an SSH public key without needing a password or the corresponding SSH private key. An SSH public key should be considered public knowledge and should not used as an authentication secret alone. JumpServer provid

CVE-2023-48193 [CRITICAL] CVE-2023-48193: Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute a Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via bypassing the command filtering function. NOTE: this is disputed because command filtering is not intended to restrict what code can be run by authorized users who are allowed to execute files.

CVE-2025-58044 [MEDIUM] CWE-601 CVE-2025-58044: JumpServer is an open source bastion host and an operation and maintenance security audit system. Pr JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability. This vulnerability is fixed in v3.10.19 and v4.10.5.

CVE-2023-28110 [CRITICAL] CWE-77 CVE-2023-28110: Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and Web Terminal service. Prior to version 2.28.8, using illegal tokens to connect to a Kubernetes cluster through Koko can result in the execution of dangerous commands that may disrupt the Koko co

CVE-2024-24763 [MEDIUM] CWE-601 CVE-2024-24763: JumpServer is an open source bastion host and an operation and maintenance security audit system. Pr JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to version 3.10.0, attackers can exploit this vulnerability to construct malicious links, leading users to click on them, thereby facilitating phishing attacks or cross-site scripting attacks. Version 3.10.0 contains a patch for this issue. No kno

CVE-2025-62712 [HIGH] CWE-862 CVE-2025-62712: JumpServer is an open source bastion host and an operation and maintenance security audit system. In JumpServer is an open source bastion host and an operation and maintenance security audit system. In JumpServer versions prior to v3.10.20-lts and v4.10.11-lts, an authenticated, non-privileged user can retrieve connection tokens belonging to other users via the super-connection API endpoint (/api/v1/authentication/super-connection-token/). When acces

CVE-2023-42819 [HIGH] CWE-22 CVE-2023-42819: JumpServer is an open source bastion host. Logged-in users can access and modify the contents of any JumpServer is an open source bastion host. Logged-in users can access and modify the contents of any file on the system. A user can use the 'Job-Template' menu and create a playbook named 'test'. Get the playbook id from the detail page, like 'e0adabef-c38f-492d-bd92-832bacc3df5f'. An attacker can exploit the directory traversal flaw using the provided

CVE-2023-42820 [HIGH] CWE-200 CVE-2023-42820: JumpServer is an open source bastion host. This vulnerability is due to exposing the random number s JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated verification codes to be replayed, which could lead to password resets. If MFA is enabled users are not affect. Users not using local authentication are also not affected. Users are advised to

CVE-2023-43650 [HIGH] CWE-640 CVE-2023-43650: JumpServer is an open source bastion host. The verification code for resetting user's password is vu JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to the absence of rate limiting. JumpServer provides a feature allowing users to reset forgotten passwords. Affected users are sent a 6-digit verification code, ranging from 000000 to 999999, to facilitate the passwor

CVE-2025-62795 [HIGH] CWE-863 CVE-2025-62795: JumpServer is an open source bastion host and an operation and maintenance security audit system. Pr JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.21-lts and v4.10.12-lts, a low-privileged authenticated user can invoke LDAP configuration tests and start LDAP synchronization by sending crafted messages to the /ws/ldap/ WebSocket endpoint, bypassing authorization checks and potentially

CVE-2026-31864 [MEDIUM] CWE-1336 CVE-2026-31864: JumpServer is an open source bastion host and an operation and maintenance security audit system. a JumpServer is an open source bastion host and an operation and maintenance security audit system. a Server-Side Template Injection (SSTI) vulnerability exists in JumpServer's Applet and VirtualApp upload functionality. This vulnerability can only be exploited by users with administrative privileges (Application Applet Management or Virtual Applicati

CVE-2023-46123 [MEDIUM] CWE-307 CVE-2023-46123: jumpserver is an open source bastion machine, professional operation and maintenance security audit jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specifications. A flaw in the Core API allows attackers to bypass password brute-force protections by spoofing arbitrary IP addresses. By exploiting this vulnerability, attackers can effectively make unlimited password atte

CVE-2024-29024 [MEDIUM] CWE-639 CVE-2024-29024: JumpServer is an open source bastion host and an operation and maintenance security audit system. An JumpServer is an open source bastion host and an operation and maintenance security audit system. An authenticated user can exploit the Insecure Direct Object Reference (IDOR) vulnerability in the file manager's bulk transfer by manipulating job IDs to upload malicious files, potentially compromising the integrity and security of the system. This vu