PT-2021-19629 · Jump Ams · Jump Ams

Thomas Pianezzola · Published 2021-08-03 · Updated 2021-08-12 · CVE-2021-32017

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N

Name of the Vulnerable Software and Affected Versions: JUMP AMS version 3.6.0.04.009-2487

Description: An issue was discovered in JUMP AMS where a JUMP SOAP endpoint permitted the listing of the content of the remote file system. This can be used to identify the complete server filesystem structure, including all directories and files.

Recommendations: For JUMP AMS version 3.6.0.04.009-2487, consider restricting access to the JUMP SOAP endpoint to minimize the risk of exploitation. As a temporary workaround, disabling the endpoint until a patch is available can help mitigate the issue.

Fix

Related Identifiers

CVE-2021-32017

Affected Products

Jump Ams

References · 6

• https://osv.dev/vulnerability/CVE-2021-32017 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32017 · Security Note
• https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-32017 · Note
• https://excellium-services.com/cert-xlm-advisory/cve-2021-32017 · Note
• https://t.me/cvenotify/18555 · Telegram Post
• https://t.me/cibsecurity/26758 · Telegram Post