PT-2023-29870 · Unknown · Jumpserver

Edwardzpeng + 2 · Published 2023-10-30 · Updated 2023-11-08 · CVE-2023-46138

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions JumpServer versions prior to 3.8.0

Description The issue concerns the default email address for the initial admin user, which is set to admin[@]mycompany[.]com. This could potentially affect password reset functionality if the domain mycompany.com is registered in the future. The estimated number of potentially affected devices is not specified.

Recommendations For versions prior to 3.8.0, update to version 3.8.0 or later. As a temporary workaround, consider changing the default email domain to example.com manually for those who cannot upgrade.

Exploit

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2023-46138

GHSA-9MRC-75CV-46CQ

Affected Products

Jumpserver

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46138.json · Exploit
• https://github.com/jumpserver/jumpserver/commit/15a5dda9e0cdbe2ac618a6b2a09df8928f485c88 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-46138 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46138 · Vendor Advisory
• https://github.com/jumpserver/jumpserver/security/advisories/GHSA-9mrc-75cv-46cq · Note