PT-2023-5833 · Unknown · Jumpserver

Edwardzpeng + 2 · Publicado 2023-09-14 · Atualizado 2025-08-26 · CVE-2023-42820

Positive Technologies (AI Summary)

CVSS v3.1

7.0

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions JumpServer versions prior to 2.28.19 JumpServer versions prior to 3.6.5

Description The issue is related to the exposure of the random number seed to the API, potentially allowing the randomly generated verification codes to be replayed, which could lead to password resets. If MFA is enabled, users are not affected. Users not using local authentication are also not affected.

Recommendations For versions prior to 2.28.19, upgrade to version 2.28.19 or later. For versions prior to 3.6.5, upgrade to version 3.6.5 or later. As a temporary workaround, consider restricting access to the API endpoint that exposes the random number seed until a patch is available. Avoid using the verification codes generated by the affected API endpoint until the issue is resolved.

Exploit

Correção

Information Disclosure

Improper Access Control

Code Injection

Enumeração de Fraquezas

CWE-200

CWE-284

CWE-94

Identificadores relacionados

BDU:2023-06519

CVE-2023-42820

GHSA-7PRV-G565-82QP

Produtos afetados

Jumpserver

Referências · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42820.json · Exploit
• 🔥 https://github.com/C1ph3rX13/CVE-2023-42820 · Exploit
• 🔥❌ https://github.com/h4m5t/CVE-2023-42820 · Exploit, Deleted
• https://github.com/jumpserver/jumpserver/security/advisories/GHSA-7prv-g565-82qp · Aviso do Fabricante
• https://github.com/jumpserver/jumpserver/commit/42337f0d00b2a8d45ef063eb5b7deeef81597da5 · Correção
• https://bdu.fstec.ru/vul/2023-06519 · Nota de Segurança
• https://twitter.com/CVEnew/status/1706770215466647560 · Publicação no Twitter
• https://twitter.com/hack_git/status/1707677113539514613 · Publicação no Twitter
• https://twitter.com/matarturo/status/1707697298308837705 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-42820 · Nota de Segurança
• https://twitter.com/cracbot/status/1707274043123171819 · Publicação no Twitter
• https://t.me/proxy_bar/1766 · Publicação no Telegram
• https://twitter.com/ksg93rd/status/1753780705002209536 · Publicação no Twitter
• https://t.me/cybersecuritytechnologies/9902 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-42820 · Aviso do Fabricante