fit2cloud jumpserver vulnerabilities and exploits

(subscribe to this query)

9.9

CVSSv3

JumpServer is an open source bastion host. An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary commands, leading to remote code execution. This vulnerability may further be leveraged to gain root privileges on the system. Through the WEB CLI...

Fit2cloud Jumpserver

1 Github repository

9.9

CVSSv3

Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and Web Terminal service. Prior to version 2.28.8, using illegal tokens to connect to a Kubernetes cluster through Koko ca...

Fit2cloud Koko -Fit2cloud Jumpserver

9.8

CVSSv3

Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote malicious user to execute arbitrary code via bypassing the command filtering function.

Fit2cloud Jumpserver 3.8.0

9.8

CVSSv3

JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding SSH private key. An attacker could exploit a vulnerability by utilizing a disclosed public key to attempt brute-force au...

Fit2cloud Jumpserver

9.1

CVSSv3

JumpServer is an open source bastion host. As an unauthenticated user, it is possible to authenticate to the core API with a username and an SSH public key without needing a password or the corresponding SSH private key. An SSH public key should be considered public knowledge and...

Fit2cloud Jumpserver

8.8

CVSSv3

JumpServer is an open source bastion host. Logged-in users can access and modify the contents of any file on the system. A user can use the 'Job-Template' menu and create a playbook named 'test'. Get the playbook id from the detail page, like 'e0adabef-c3...

Fit2cloud Jumpserver

2 Github repositories

8.2

CVSSv3

JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated verification codes to be replayed, which could lead to password resets. If MFA is enabled users are not affect. Users no...

Fit2cloud Jumpserver

4 Github repositories

7.4

CVSSv3

JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to the absence of rate limiting. JumpServer provides a feature allowing users to reset forgotten passwords. Affected users are sent a 6-dig...

Fit2cloud Jumpserver

5.4

CVSSv3

Jumpserver 2.10.0 <= version <= 2.26.0 contains multiple stored XSS vulnerabilities because of improper filtering of user input, which can execute any javascript under admin's permission.

Fit2cloud Lina

5.3

CVSSv3

JumpServer is an open source bastion host and maintenance security audit system that complies with 4A specifications. Prior to version 3.8.0, the default email for initial user admin is `admin[@]mycompany[.]com`, and users reset their passwords by sending an email. Currently, the...

Fit2cloud Jumpserver

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook