PT-2024-22674 · Unknown · Jumpserver

Ilyazavyalov · Published 2024-03-29 · Updated 2025-01-09 · CVE-2024-29020

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions JumpServer versions prior to 3.10.6

Description An authorized attacker can obtain sensitive information contained within playbook files if they manage to learn the playbook id of another user. This breach of confidentiality can lead to information disclosure and exposing sensitive data.

Recommendations For versions prior to 3.10.6, update to version 3.10.6 to resolve the issue. As a temporary workaround, consider restricting access to playbook files and limiting the ability for authorized attackers to learn the playbook id of other users.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-29020

GHSA-7MQC-23HR-CR62

Affected Products

Jumpserver

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29020.json · Exploit
• https://github.com/jumpserver/jumpserver/security/advisories/GHSA-7mqc-23hr-cr62 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-29020 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29020 · Security Note
• https://twitter.com/CVEnew/status/1773724952648192010 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1773753454957125721 · Twitter Post