Jpom
Monthly
Unauthenticated super-administrator access in Jpom 2.10.0 through 2.11.12 is possible through query-condition injection in the JPOM-USER-TOKEN header, where a value such as 'is not null' is treated by Hutool's Condition parser as an operator and bypasses LoginInterceptor authentication. The resulting super-administrator role can then use Jpom's script features to execute commands. The issue is rated act_now with CVSS 9.3; no CISA KEV entry or confirmed public exploit code is provided in the supplied data, and the trigger is remote and unauthenticated against default configurations.
Cross-workspace authorization bypass in Jpom through 2.11.12 (CWE-639, IDOR) lets any authenticated user who holds SSH file permissions in one workspace read, modify, or delete files on SSH hosts that belong to a different workspace. The flaw resides in SshFileController, where the caller-supplied SSH asset id is used to resolve the target host without verifying that the asset actually belongs to the caller's workspace, so the reachable endpoints (download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json, new_file_folder.json) operate on foreign assets. Exploitation requires a multi-workspace deployment with at least one SSH host asset outside the attacker's workspace and knowledge or enumeration of that host's asset id; no public exploit code is confirmed at time of analysis, though a public technical write-up (linked from the CVE record) explains the technique, and the issue is not listed in CISA KEV, so there is no evidence of active exploitation. Assigned CVSS 4.0 base 8.6 (with our 3.1 assessment at AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects high confidentiality and integrity impact while the CVSS 4.0 vector shows no availability impact.
Jpom through 2.11.12 exposes a broken object-level authorization flaw on the /build/branch-list endpoint, letting any authenticated user supply a repositoryId belonging to a different workspace and have the server resolve it without verifying ownership. This enables cross-workspace repository enumeration, disclosure of repository type, and execution of git ls-remote calls that reuse another workspace's stored Git credentials, leaking private repository metadata. Exploitation is low-complexity over the network with only a low-privileged account required, and publicly available exploit code exists, though the CVSS 4.0 base score is only 5.3 because the impact is limited to confidentiality.
Unauthenticated super-administrator access in Jpom 2.10.0 through 2.11.12 is possible through query-condition injection in the JPOM-USER-TOKEN header, where a value such as 'is not null' is treated by Hutool's Condition parser as an operator and bypasses LoginInterceptor authentication. The resulting super-administrator role can then use Jpom's script features to execute commands. The issue is rated act_now with CVSS 9.3; no CISA KEV entry or confirmed public exploit code is provided in the supplied data, and the trigger is remote and unauthenticated against default configurations.
Cross-workspace authorization bypass in Jpom through 2.11.12 (CWE-639, IDOR) lets any authenticated user who holds SSH file permissions in one workspace read, modify, or delete files on SSH hosts that belong to a different workspace. The flaw resides in SshFileController, where the caller-supplied SSH asset id is used to resolve the target host without verifying that the asset actually belongs to the caller's workspace, so the reachable endpoints (download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json, new_file_folder.json) operate on foreign assets. Exploitation requires a multi-workspace deployment with at least one SSH host asset outside the attacker's workspace and knowledge or enumeration of that host's asset id; no public exploit code is confirmed at time of analysis, though a public technical write-up (linked from the CVE record) explains the technique, and the issue is not listed in CISA KEV, so there is no evidence of active exploitation. Assigned CVSS 4.0 base 8.6 (with our 3.1 assessment at AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects high confidentiality and integrity impact while the CVSS 4.0 vector shows no availability impact.
Jpom through 2.11.12 exposes a broken object-level authorization flaw on the /build/branch-list endpoint, letting any authenticated user supply a repositoryId belonging to a different workspace and have the server resolve it without verifying ownership. This enables cross-workspace repository enumeration, disclosure of repository type, and execution of git ls-remote calls that reuse another workspace's stored Git credentials, leaking private repository metadata. Exploitation is low-complexity over the network with only a low-privileged account required, and publicly available exploit code exists, though the CVSS 4.0 base score is only 5.3 because the impact is limited to confidentiality.