CVE-2023-42442: falha de alta gravidade em jumpserver
JumpServer session replays download without authentication
Publicada em · Atualizada em
48Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendcvss 8.2epss 63%
probabilidade de exploração
63%top 1% das CVEs
exploração observada
nãonenhuma fonte reporta
JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not affected. The api `/api/v1/terminal/sessions/` permission control is broken and can be accessed anonymously. SessionViewSet permission classes set to `[RBACPermission | IsSessionAssignee]`, relation is or, so any permission matched will be allowed. Versions 3.5.5 and 3.6.4 have a fix. After upgrading, visit the api `$HOST/api/v1/terminal/sessions/?limit=1`. The expected http response code is 401 (`not_authenticated`).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Produtos afetados
jumpserver · jumpserverCVEs relacionadas — jumpserver
No mesmo produto, das mais perigosas para as menos.
CVE-2023-42820HIGHRandom seed leakage in JumpserverEPSS 6.3%CVE-2024-29201CRITICALJumpServer's insecure Ansible playbook validation leads to RCE in CeleryEPSS 6.0%CVE-2024-29202CRITICALJumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in CeleryEPSS 5.9%CVE-2023-42819HIGHPath traversal in JumpserverEPSS 2.2%CVE-2023-43651HIGHRemote code execution on the host system via MongoDB shell in jumpserverEPSS 2.1%CVE-2024-40629CRITICALArbitrary File Write in Ansible Playbooks leads to RCE in JumpserverEPSS 1.3%