CVE-2024-24763

MEDIUMNuclei

JumpServer Open Redirect Vulnerability

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-24763 has a selected CVSS score of 4.3 (medium); EIP currently links 1 Nuclei template.

Description

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to version 3.10.0, attackers can exploit this vulnerability to construct malicious links, leading users to click on them, thereby facilitating phishing attacks or cross-site scripting attacks. Version 3.10.0 contains a patch for this issue. No known workarounds are available.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 22, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

jumpserver

Browse jumpserver / jumpserver
CVE List< 3.10.0affected

Nuclei templates

1
ProjectDiscoveryMEDIUMJumpServer < 3.10.0 - Open RedirectCVSS 4.3

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to version 3.10.0, attackers can exploit this vulnerability to construct malicious links, leading users to click on them, thereby facilitating phishing attacks or cross-site scripting attacks. Version 3.10.0 contains a patch for this issue. No known workarounds are available.

Impact

Unauthenticated attackers can redirect users to malicious URLs via the next parameter, facilitating phishing attacks or cross-site scripting.

Remediation

Update JumpServer to version 3.10.0 or later.

WeaknessesCWE-601
Authorsritikchaddha
Template tagscve2024cvejumpserverredirectfit2cloudauthenticatedvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CPE: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
FOFA: title="JumpServer"
FOFA: title="jumpserver"
https://github.com/jumpserver/jumpserver/security/advisories/GHSA-p2mq-cm25-g4m5 https://nvd.nist.gov/vuln/detail/CVE-2024-24763

Source: ProjectDiscovery

References

2