What is CVE-2024-29024?

CVE-2024-29024 is a medium-severity vulnerability in Fit2cloud Jumpserver, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.6/10. Published 2024-03-29.

How severe is CVE-2024-29024?

Medium severity. CVSS v3 base score is 4.6 out of 10.

Auth bypass in Fit2cloud Jumpserver

CVE-2024-29024

JumpServer is an open source bastion host and an operation and maintenance security audit system. An authenticated user can exploit the Insecure Direct Object Reference (IDOR) vulnerability in the file manager's bulk transfer by manipulati…

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.002 (14.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.6 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L.

Affected products

Fit2cloud Jumpserver
Jumpserver — versions >= 3.0.0, <= 3.10.5

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2024-29024?: CVE-2024-29024 is a medium-severity vulnerability in Fit2cloud Jumpserver, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.6/10. Published 2024-03-29.
How severe is CVE-2024-29024?: Medium severity. CVSS v3 base score is 4.6 out of 10.