Path traversal in Jumpserver
CVE-2023-42819
Key Information:
- Vendor
Jumpserver
- Status
- Vendor
- CVE Published:
- 27 September 2023
Badges
What is CVE-2023-42819?
JumpServer, an open source bastion host, is vulnerable to a directory traversal flaw allowing authenticated users to access and modify system files. This vulnerability arises from improper validation of user input, enabling users to construct URLs that traverse the directory structure. An attacker could exploit this flaw by retrieving sensitive files, such as '/etc/passwd', or altering file contents using specific playbook identifiers obtained from the application. Users are strongly encouraged to upgrade to version 3.6.5 or later to safeguard their systems, as there are no available workarounds.
Affected Version(s)
jumpserver >= 3.0.0, < 3.6.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.