Vulnerability · Published Oct 25, 2023 · Assigned by GitHub_M
CVE-2023-46123jumpserver is vulnerable to password brute-force protection bypass via arbitrary IP values
Medium 5.3
In plain English
A medium-severity security flaw in jumpserver from jumpserver. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Official description
jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specifications. A flaw in the Core API allows attackers to bypass password brute-force protections by spoofing arbitrary IP addresses. By exploiting this vulnerability, attackers can effectively make unlimited password attempts by altering their apparent IP address for each request. This vulnerability has been patched in version 3.8.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| jumpserver | jumpserver | < 3.8.0 |
Weakness: CWE-307 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N