JU
Product
jumpserver
29
CVEs
0
On KEV
9.9
Max CVSS
2
New 30D
Severity mix
Critical 9High 5Medium 15Low 0
Watch
Add jumpserver to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-29202 | 9.9 | Mar 29 | JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery Affected: >= 3.0.0, <= 3.10.6 |
| CVE-2024-29201 | 9.9 | Mar 29 | JumpServer's insecure Ansible playbook validation leads to RCE in Celery Affected: >= 3.0.0, <= 3.10.6 |
| CVE-2023-43651 | 9.9 | Sep 27 | Remote code execution on the host system via MongoDB shell in jumpserver Affected: >= 2.0.0, < 2.28.20; >= 3.0.0, < 3.7.1 |
| CVE-2023-28110 | 9.9 | Mar 16 | JumpServer Koko vulnerable to Command Injection for Kubernetes Connection Affected: < 2.28.8 |
| CVE-2024-40629 | 9.8 | Jul 18 | Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver Affected: >= 3.0.0, < 3.10.12 |
| CVE-2023-42818 | 9.8 | Sep 27 | SSH public key login without private key challenge if mfa is enabled in jumpserver Affected: >= 3.6.0, < 3.6.5; < 3.5.6 |
| CVE-2021-3169 | 9.8 | Jul 23 | An issue in Jumpserver before 2.6.2, before 2.5.4, before 2.4.5 allows attackers to create a connection token through an API which does not have access control and use it to… Affected: 2.4.0 before 2.4.5; 2.5.0 before 2.5.4; 2.6.0 before 2.6.2 |
| CVE-2024-40628 | 9.1 | Jul 18 | Arbitrary File Read in Ansible Playbooks in Jumpserver Affected: >= 3.0.0, < 3.10.12 |
| CVE-2023-43652 | 9.1 | Sep 27 | Non-MFA account takeover via using only SSH public key to login in jumpserver Affected: >= 2.0.0, < 2.28.20; >= 3.0.0, < 3.7.1 |
Showing 9