Vulnerability · Published Feb 20, 2024 · Assigned by GitHub_M

CVE-2024-24763JumpServer Open Redirect Vulnerability

Medium 4.3

In plain English

A medium-severity open redirect in jumpserver from jumpserver. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)1.1%top 35.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to version 3.10.0, attackers can exploit this vulnerability to construct malicious links, leading users to click on them, thereby facilitating phishing attacks or cross-site scripting attacks. Version 3.10.0 contains a patch for this issue. No known workarounds are available.

Affected products (as reported)

Vendor	Product	Versions
jumpserver	jumpserver	< 3.10.0

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

References

https://github.com/jumpserver/jumpserver/security/advisories/GHSA-p2mq-cm25-g4m5 x_refsource_CONFIRM
https://github.com/jumpserver/jumpserver/releases/tag/v3.10.0 x_refsource_MISC