PT-2021-19475 · Unknown · Jumpserver

Published 2021-07-23 · Updated 2024-01-29 · CVE-2021-3169

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jumpserver versions prior to 2.6.2 Jumpserver versions prior to 2.5.4 Jumpserver versions prior to 2.4.5

Description An issue in Jumpserver allows attackers to create a connection token through an API which does not have access control and use it to access sensitive assets.

Recommendations For versions prior to 2.6.2, update to version 2.6.2 or later. For versions prior to 2.5.4, update to version 2.5.4 or later. For versions prior to 2.4.5, update to version 2.4.5 or later.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2021-3169

Affected Products

Jumpserver

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-3169 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3169 · Vendor Advisory
• https://mp.weixin.qq.com/s/5tgcaIrnDnGP-LvWPw9YCg · Note
• https://t.me/cibsecurity/26452 · Telegram Post
• https://s.tencent.com/research/bsafe/1228.html · Note
• https://blog.fit2cloud.com/?p=1764 · Note
• https://t.me/cvenotify/69154 · Telegram Post