Vulnerability in Fit2cloud Jumpserver
CVE-2023-46123
jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specifications. A flaw in the Core API allows attackers to bypass password brute-force protections by spoofing arbitrary IP addresses. By exploiting this vulnerability, attackers can effectively make unlimited password attempts by altering their apparent IP address for each request. This vulnerability has been patched in version 3.8.0.
EPSS: 0.007 (51.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Fit2cloud Jumpserver
- Jumpserver — versions < 3.8.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- security-advisories@github.com (x_refsource_MISC, Release Notes)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2023-46123?
- CVE-2023-46123 is a medium-severity vulnerability in Fit2cloud Jumpserver, classified under Improper Restriction of Excessive Authentication Attempts. CVSS score: 5.3/10. Published 2023-10-25.
- How severe is CVE-2023-46123?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2023-46123 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.