JumpServer CVE-2025-62795

Requires a valid low-privileged authenticated account on the JumpServer instance (PR:L) and network reachability to the application's WebSocket interface, specifically the /ws/ldap/ endpoint. The deployment must have LDAP integration configured for the credential-exposure impact to be meaningful, since the abused actions are LDAP configuration tests and LDAP synchronization; against an instance with no LDAP configuration the practical impact is limited to triggering benign/empty sync operations. Affected only on versions prior to v3.10.21-lts and v4.10.12-lts. The main limiting factor is the authentication requirement - exploitation is not available to fully anonymous attackers - while no special user interaction and low attack complexity otherwise make it easy for any account holder.

This is a moderate-priority authorization flaw, not a critical remote-code-execution emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, base 7.1) indicates network-reachable, low-complexity exploitation requiring an existing low-privileged authenticated account (PR:L), with high confidentiality impact (LDAP credential exposure) but only low integrity impact (unintended sync operations) and no availability impact. A public exploit reference exists (the GitHub Security Advisory GHSA-7893-256g-m822, flagged as exploit in the NVD reference), so publicly available exploit code exists - but this is NOT confirmed active exploitation: the CVE is not listed in CISA KEV, and no EPSS probability was provided in the input. No SSVC decision data was supplied. The key gating factor is PR:L: an attacker must already hold valid low-privileged credentials on the JumpServer instance, which meaningfully narrows the threat to insiders or attackers who have already obtained a foothold/account, rather than fully anonymous internet attackers. Net: credible and worth patching promptly for a privileged-access-management product (where LDAP credential leakage is high-value), but it is a privilege/authorization bug requiring authentication, not a wormable zero-day.

A low-privileged but authenticated JumpServer user opens a WebSocket connection to the /ws/ldap/ endpoint and sends crafted messages that invoke LDAP configuration tests and trigger LDAP synchronization, actions that should be restricted to administrators. Because authorization checks are bypassed, the attacker can coerce the server into performing a test/sync that may disclose configured LDAP bind credentials or cause unintended directory sync operations. Public exploit/advisory material exists (GHSA-7893-256g-m822), and the low attack complexity (AC:L) makes the request trivial to craft once a foothold account is available.