Access Control Issue in Jumpserver by Jumpserver
CVE-2021-3169

9.8CRITICAL

Key Information:

Vendor

Jumpserver

Status
Jumpserver
Vendor
CVE Published:
23 July 2021

What is CVE-2021-3169?

Jumpserver versions 2.6.2 and earlier contain a security flaw that enables attackers to generate connection tokens through an API lacking proper access control measures. This vulnerability permits unauthorized users to exploit these tokens to gain access to sensitive resources, potentially leading to data breaches and unauthorized actions within the system.

References

https://mp.weixin.qq.com/s/5tgcaIrnDnGP-LvWPw9YCg
https://s.tencent.com/research/bsafe/1228.html
https://blog.fit2cloud.com/?p=1764

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.