CVE-2025-62795

HIGH

fit2cloud jumpserver < 3.10.21 - Authenticated Incorrect Authorization via LDAP WebSocket Endpoint

Title source: llm
STIX 2.1

Description

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.21-lts and v4.10.12-lts, a low-privileged authenticated user can invoke LDAP configuration tests and start LDAP synchronization by sending crafted messages to the /ws/ldap/ WebSocket endpoint, bypassing authorization checks and potentially exposing LDAP credentials or causing unintended sync operations. This vulnerability is fixed in v3.10.21-lts and v4.10.12-lts.

References (1)

Core 1
Core References

Scores

CVSS v3 7.1
EPSS 0.0024
EPSS Percentile 14.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-863
Status published
Products (1)
fit2cloud/jumpserver < 3.10.21
Published Oct 30, 2025
Tracked Since Feb 18, 2026