What is CVE-2024-29020?

CVE-2024-29020 is a medium-severity vulnerability in Fit2cloud Jumpserver, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.6/10. Published 2024-03-29.

How severe is CVE-2024-29020?

Medium severity. CVSS v3 base score is 4.6 out of 10.

Auth bypass in Fit2cloud Jumpserver

CVE-2024-29020

JumpServer is an open source bastion host and an operation and maintenance security audit system. An authorized attacker can obtain sensitive information contained within playbook files if they manage to learn the playbook_id of another user. This breach of confidentiality can lead to information disclosure and exposing sensitive data. This vulnerability is fixed in v3.10.6.

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.003 (21.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.6 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L.

Affected products

Fit2cloud Jumpserver
Jumpserver — versions >= 3.0.0, <= 3.10.5

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2024-29020?: CVE-2024-29020 is a medium-severity vulnerability in Fit2cloud Jumpserver, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.6/10. Published 2024-03-29.
How severe is CVE-2024-29020?: Medium severity. CVSS v3 base score is 4.6 out of 10.