CVE-2023-28110

MEDIUM

fit2cloud jumpserver < 2.28.8 - Command Injection via Illegal Kubernetes Tokens

Title source: llm

Description

Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and Web Terminal service. Prior to version 2.28.8, using illegal tokens to connect to a Kubernetes cluster through Koko can result in the execution of dangerous commands that may disrupt the Koko container environment and affect normal usage. The vulnerability has been fixed in v2.28.8.

References (2)

Core 2

Core References

Exploit, Vendor Advisory x_refsource_confirm

https://github.com/jumpserver/jumpserver/security/advisories/GHSA-6x5p-jm59-jh29

Patch, Release Notes x_refsource_misc

https://github.com/jumpserver/jumpserver/releases/tag/v2.28.8

Scores

CVSS v3 5.7

EPSS 0.0085

EPSS Percentile 53.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-77

Status published

Products (2)

fit2cloud/jumpserver < 2.28.8

fit2cloud/koko

Published Mar 16, 2023

Tracked Since Feb 18, 2026