What is CVE-2024-24763?

CVE-2024-24763 is a medium-severity vulnerability in Fit2cloud Jumpserver, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 4.3/10. Published 2024-02-20.

How severe is CVE-2024-24763?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Is CVE-2024-24763 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Open Redirect in Fit2cloud Jumpserver

CVE-2024-24763

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to version 3.10.0, attackers can exploit this vulnerability to construct malicious links, leading users to click on them, thereby facilitating phishing attacks or cross-site scripting attacks. Version 3.10.0 contains a patch for this issue. No known workarounds are available.

Vulnerability class: Open Redirect

EPSS: 0.011 (61.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L.

Affected products

Fit2cloud Jumpserver
Jumpserver — versions < 3.10.0

Weakness classification (CWE)

CWE-601 — URL Redirection to Untrusted Site (Open Redirect)

Public proof-of-concept exploits

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (x_refsource_MISC, Release Notes)

Frequently asked questions

What is CVE-2024-24763?: CVE-2024-24763 is a medium-severity vulnerability in Fit2cloud Jumpserver, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 4.3/10. Published 2024-02-20.
How severe is CVE-2024-24763?: Medium severity. CVSS v3 base score is 4.3 out of 10.
Is CVE-2024-24763 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.