PT-2023-29870 · Unknown · Jumpserver

Edwardzpeng + 2 · Publicado 2023-10-30 · Atualizado 2023-11-08 · CVE-2023-46138

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions JumpServer versions prior to 3.8.0

Description The issue concerns the default email address for the initial admin user, which is set to admin[@]mycompany[.]com. This could potentially affect password reset functionality if the domain mycompany.com is registered in the future. The estimated number of potentially affected devices is not specified.

Recommendations For versions prior to 3.8.0, update to version 3.8.0 or later. As a temporary workaround, consider changing the default email domain to example.com manually for those who cannot upgrade.

Exploit

Correção

Enumeração de Fraquezas

CWE-640

Identificadores relacionados

CVE-2023-46138

GHSA-9MRC-75CV-46CQ

Produtos afetados

Jumpserver

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46138.json · Exploit
• https://github.com/jumpserver/jumpserver/security/advisories/GHSA-9mrc-75cv-46cq · Nota
• https://github.com/jumpserver/jumpserver/commit/15a5dda9e0cdbe2ac618a6b2a09df8928f485c88 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-46138 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-46138 · Aviso do Fabricante