Fit2cloud
Fit2cloud Jumpserver: vulnerabilidades y CVE
Fit2cloud Jumpserver tiene 24 vulnerabilidades publicadas, 5 de ellas en los últimos 12 meses. 9 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE24
Últimos 12 meses5
Críticas9
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-31864 | Media (6.8) | 0.52% | — | 13 mar 2026 | JumpServer is an open source bastion host and an operation and maintenance security audit system. a Server-Side Template Injection (SSTI) vulnerability exists in JumpServer's Applet and VirtualApp upload functionality.… |
| CVE-2026-31798 | Media (5) | 0.12% | — | 13 mar 2026 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v4.10.16-lts, JumpServer improperly validates certificates in the Custom SMS API Client. When JumpServer sends… |
| CVE-2025-58044 | Media (5.5) | 0.49% | — | 1 dic 2025 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper… |
| CVE-2025-62795 | Alta (7.1) | 0.29% | — | 30 oct 2025 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.21-lts and v4.10.12-lts, a low-privileged authenticated user can invoke LDAP configuration tests and start… |
| CVE-2025-62712 | Alta (8.1) | 0.50% | — | 30 oct 2025 | JumpServer is an open source bastion host and an operation and maintenance security audit system. In JumpServer versions prior to v3.10.20-lts and v4.10.11-lts, an authenticated, non-privileged user can retrieve… |
| CVE-2025-27095 | Media (4.3) | 0.32% | — | 31 mar 2025 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.8.0 and 3.10.18, an attacker with a low-privileged account can access the Kubernetes session feature and… |
| CVE-2024-40629 | Crítica (9.8) | 1.3% | — | 18 jul 2024 | JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An… |
| CVE-2024-40628 | Crítica (9.1) | 0.86% | — | 18 jul 2024 | JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An… |
| CVE-2024-29202 | Crítica (9.9) | 5.9% | — | 29 mar 2024 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template injection vulnerability in JumpServer's Ansible to execute arbitrary code within… |
| CVE-2024-29201 | Crítica (9.9) | 5.9% | — | 29 mar 2024 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpServer's Ansible to execute arbitrary code within the Celery… |
| CVE-2024-29024 | Media (5.3) | 0.24% | — | 29 mar 2024 | JumpServer is an open source bastion host and an operation and maintenance security audit system. An authenticated user can exploit the Insecure Direct Object Reference (IDOR) vulnerability in the file manager's bulk… |
| CVE-2024-29020 | Media (5.3) | 0.29% | — | 29 mar 2024 | JumpServer is an open source bastion host and an operation and maintenance security audit system. An authorized attacker can obtain sensitive information contained within playbook files if they manage to learn the… |
| CVE-2024-24763 | Media (6.1) | 1.1% | — | 20 feb 2024 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to version 3.10.0, attackers can exploit this vulnerability to construct malicious links, leading users to click on… |
| CVE-2023-48193 | Crítica (9.8) | 2.0% | — | 28 nov 2023 | Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via bypassing the command filtering function. NOTE: this is disputed because command filtering is not… |
| CVE-2023-46138 | Media (5.3) | 0.32% | — | 31 oct 2023 | JumpServer is an open source bastion host and maintenance security audit system that complies with 4A specifications. Prior to version 3.8.0, the default email for initial user admin is `admin[@]mycompany[.]com`, and… |
| CVE-2023-46123 | Media (5.3) | 0.70% | — | 25 oct 2023 | jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specifications. A flaw in the Core API allows attackers to bypass password brute-force… |
| CVE-2023-43651 | Crítica (9.9) | 2.1% | — | 27 sept 2023 | JumpServer is an open source bastion host. An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary commands, leading to remote code execution. This vulnerability may further be… |
| CVE-2023-42818 | Crítica (9.8) | 0.68% | — | 27 sept 2023 | JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding SSH private key. An attacker could exploit a vulnerability… |
| CVE-2023-43652 | Crítica (9.1) | 0.81% | — | 27 sept 2023 | JumpServer is an open source bastion host. As an unauthenticated user, it is possible to authenticate to the core API with a username and an SSH public key without needing a password or the corresponding SSH private… |
| CVE-2023-43650 | Alta (7.4) | 0.60% | — | 27 sept 2023 | JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to the absence of rate limiting. JumpServer provides a feature allowing users to… |
| CVE-2023-42820 | Alta (8.2) | 6.3% | — | 27 sept 2023 | JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated verification codes to be replayed, which could lead to… |
| CVE-2023-42819 | Alta (8.8) | 2.2% | — | 27 sept 2023 | JumpServer is an open source bastion host. Logged-in users can access and modify the contents of any file on the system. A user can use the 'Job-Template' menu and create a playbook named 'test'. Get the playbook id… |
| CVE-2023-42442 | Media (5.3) | 59% | — | 15 sept 2023 | JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without… |
| CVE-2023-28110 | Crítica (9.9) | 0.85% | — | 16 mar 2023 | Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and Web Terminal service. Prior to version 2.28.8, using illegal… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.