Jumpserver CVE-2024-29020

MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2024-03-29 security-advisories@github.com

Authentication Bypass Information Disclosure Jumpserver

5.3

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

1

CVE Published

Mar 29, 2024 - 15:15 nvd

MEDIUM 5.3

DescriptionNVD

JumpServer is an open source bastion host and an operation and maintenance security audit system. An authorized attacker can obtain sensitive information contained within playbook files if they manage to learn the playbook_id of another user. This breach of confidentiality can lead to information disclosure and exposing sensitive data. This vulnerability is fixed in v3.10.6.

AnalysisAI

JumpServer is an open source bastion host and an operation and maintenance security audit system. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-639. JumpServer is an open source bastion host and an operation and maintenance security audit system. An authorized attacker can obtain sensitive information contained within playbook files if they manage to learn the playbook_id of another user. This breach of confidentiality can lead to information disclosure and exposing sensitive data. This vulnerability is fixed in v3.10.6. Affected products include: Fit2Cloud Jumpserver.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Jumpserver

View all

CVE-2023-48193 CRITICAL Act Now POC

Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via by

CVE-2024-29202 CRITICAL Act Now POC

JumpServer is an open source bastion host and an operation and maintenance security audit system. Rated critical severit

CVE-2024-29201 CRITICAL Act Now POC

JumpServer is an open source bastion host and an operation and maintenance security audit system. Rated critical severit

CVE-2023-43651 CRITICAL Act Now POC

JumpServer is an open source bastion host. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitabl

CVE-2023-28110 CRITICAL Act Now POC

Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, ref

CVE-2023-42818 CRITICAL Act Now POC

JumpServer is an open source bastion host. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitabl

CVE-2023-43652 CRITICAL Act Now POC

JumpServer is an open source bastion host. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitabl

CVE-2023-43650 HIGH This Week POC

JumpServer is an open source bastion host. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, n

CVE-2025-58044 MEDIUM This Month POC

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and

CVE-2024-24763 MEDIUM This Month POC

JumpServer is an open source bastion host and an operation and maintenance security audit system. Rated medium severity

CVE-2024-40629 CRITICAL Act Now

JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand an

CVE-2021-3169 CRITICAL Act Now

An issue in Jumpserver before 2.6.2, before 2.5.4, before 2.4.5 allows attackers to create a connection token through an

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all

CVE-2024-50483 CRITICAL

CVE-2026-55255 HIGH POC

CVE-2025-3605 CRITICAL POC

CVE-2022-3805 HIGH POC

CVE-2025-5947 CRITICAL POC

CVE-2020-36923 CRITICAL POC

CVE-2023-3048 CRITICAL POC

CVE-2024-27730 CRITICAL POC

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2013-2465 CRITICAL POC

CVE-2011-3544 CRITICAL POC

CVE-2012-1723 CRITICAL POC

CVE-2017-10271 HIGH POC

CVE-2015-1427 CRITICAL POC

CVE-2025-3248 CRITICAL POC

Share

CVE-2024-29020 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy