Medium severity · published Oct 25, 2023
CVE-2023-46123
jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specifications
5.3
CVSS
0.9%
EPSS
No
On KEV
Description
jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specifications. A flaw in the Core API allows attackers to bypass password brute-force protections by spoofing arbitrary IP addresses. By exploiting this vulnerability, attackers can effectively make unlimited password attempts by altering their apparent IP address for each request. This vulnerability has been patched in version 3.8.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JU
Jumpserver · Fit2cloud
before 3.8.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-46123
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-46123
Release Notes
https://github.com/jumpserver/jumpserver/releases/tag/v3.8.0
Exploit
https://github.com/jumpserver/jumpserver/security/advisories/GHSA-hvw4-766m-p89f
www.sonarsource.com
https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-1-2
More from Jumpserver
9.9
CVE-2024-29202
JumpServer is an open source bastion host and an operation and maintenance security audit system
9.9
CVE-2024-29201
JumpServer is an open source bastion host and an operation and maintenance security audit system
9.9
CVE-2023-43651
JumpServer is an open source bastion host
9.9
CVE-2023-28110
Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and Web Terminal service
9.8
CVE-2024-40629
JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and…