PT-2023-30721 · Unknown · Jumpserver

Christian Fischer · Publicado 2023-11-28 · Atualizado 2024-08-02 · CVE-2023-48193

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JumpServer GPLv3 version 3.8.0

Description The issue allows a remote attacker to execute arbitrary code by bypassing the command filtering function. It is noted that command filtering is not intended to restrict what code can be run by authorized users who are allowed to execute files.

Recommendations For JumpServer GPLv3 version 3.8.0, consider restricting access to command execution features to minimize the risk of exploitation until a fix is available. As a temporary workaround, review and limit the permissions of authorized users to execute files, ensuring they align with the intended security posture.

Exploit

Correção

Identificadores relacionados

CVE-2023-48193

Produtos afetados

Jumpserver

Referências · 10

• 🔥 https://github.com/296430468/lcc_test/blob/main/jumpserver_BUG.md · Exploit
• https://github.com/jumpserver/jumpserver/issues/13394 · Nota
• https://github.com/jumpserver/jumpserver · Nota
• https://t.me/cvenotify/62154 · Publicação no Telegram
• https://blog.fit2cloud.com/?p=8cf83cd9-c23b-4625-9350-38926fb7f88e · Nota
• https://t.me/cvenotify/88664 · Publicação no Telegram
• http://jumpserver.com · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-48193 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-48193 · Aviso do Fabricante
• https://t.me/cvenotify/61455 · Publicação no Telegram