Medium severity · published Oct 25, 2023
CVE-2023-46123
jumpserver is vulnerable to password brute-force protection bypass via arbitrary IP values
5.3
CVSS
0.9%
EPSS
No
On KEV
Description
jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specifications. A flaw in the Core API allows attackers to bypass password brute-force protections by spoofing arbitrary IP addresses. By exploiting this vulnerability, attackers can effectively make unlimited password attempts by altering their apparent IP address for each request. This vulnerability has been patched in version 3.8.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JU
jumpserver · jumpserver
< 3.8.0 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-46123
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-46123
Release Notes
https://github.com/jumpserver/jumpserver/releases/tag/v3.8.0
Exploit
https://github.com/jumpserver/jumpserver/security/advisories/GHSA-hvw4-766m-p89f
www.sonarsource.com
https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-1-2
More from jumpserver
9.9
CVE-2024-29202
JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery
9.9
CVE-2024-29201
JumpServer's insecure Ansible playbook validation leads to RCE in Celery
9.9
CVE-2023-43651
Remote code execution on the host system via MongoDB shell in jumpserver
9.8
CVE-2024-40629
Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver
9.8
CVE-2023-42818
SSH public key login without private key challenge if mfa is enabled in jumpserver