Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via bypassing the command filtering function. NOTE: this is disputed because command filtering is not intended to restrict what code can be run by authorized users who are allowed to execute files.
AnalysisAI
Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via bypassing the command filtering function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via bypassing the command filtering function. NOTE: this is disputed because command filtering is not intended to restrict what code can be run by authorized users who are allowed to execute files. Affected products include: Fit2Cloud Jumpserver.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Jumpserver
View allJumpServer is an open source bastion host and an operation and maintenance security audit system. Rated critical severit
JumpServer is an open source bastion host and an operation and maintenance security audit system. Rated critical severit
JumpServer is an open source bastion host. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitabl
Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, ref
JumpServer is an open source bastion host. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitabl
JumpServer is an open source bastion host. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitabl
JumpServer is an open source bastion host. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, n
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and
JumpServer is an open source bastion host and an operation and maintenance security audit system. Rated medium severity
JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand an
An issue in Jumpserver before 2.6.2, before 2.5.4, before 2.4.5 allows attackers to create a connection token through an
jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies
Share
External POC / Exploit Code
Leaving vuln.today