PT-2024-20541 · Unknown · Jumpserver

Cainor · Published 2024-02-20 · Updated 2024-12-17 · CVE-2024-24763

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions JumpServer versions prior to 3.10.0

Description The issue affects JumpServer, an open source bastion host and operation and maintenance security audit system. Attackers can exploit this to construct malicious links, leading users to click on them, thereby facilitating phishing attacks or cross-site scripting attacks.

Recommendations For versions prior to 3.10.0, update to version 3.10.0 to resolve the issue. As a temporary workaround, consider restricting user access to links from untrusted sources until the update is applied.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-24763

GHSA-P2MQ-CM25-G4M5

Affected Products

Jumpserver

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24763.json · Exploit
• https://github.com/jumpserver/jumpserver/security/advisories/GHSA-p2mq-cm25-g4m5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24763 · Security Note
• https://osv.dev/vulnerability/CVE-2024-24763 · Vendor Advisory
• https://github.com/jumpserver/jumpserver/releases/tag/v3.10.0 · Note
• https://twitter.com/CVEnew/status/1759999868863688804 · Twitter Post
• https://t.me/cvenotify/104599 · Telegram Post