Fit2cloud Jumpserver
24 CVEs affecting Fit2cloud Jumpserver. Latest disclosed: 2026-03-13. Critical: 6, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-40629 | Critical | 10.0 | 2024-07-18 | JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes… |
CVE-2024-40628 | Critical | 10.0 | 2024-07-18 | JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes… |
CVE-2024-29202 | Critical | 9.9 | 2024-03-29 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template injection vulnerabili… |
CVE-2024-29201 | Critical | 9.9 | 2024-03-29 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpSe… |
CVE-2023-48193 | Critical | 9.8 | 2023-11-28 | Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via bypassing the command filtering function… |
CVE-2025-62712 | Critical | 9.6 | 2025-10-30 | JumpServer is an open source bastion host and an operation and maintenance security audit system. In JumpServer versions prior to v3.10.20-lts and v4.10.11-lts… |
CVE-2023-42819 | High | 8.9 | 2023-09-27 | JumpServer is an open source bastion host. Logged-in users can access and modify the contents of any file on the system. A user can use the 'Job-Template' menu… |
CVE-2023-43651 | High | 8.5 | 2023-09-27 | JumpServer is an open source bastion host. An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary commands, leading to remo… |
CVE-2023-43652 | High | 8.2 | 2023-09-27 | JumpServer is an open source bastion host. As an unauthenticated user, it is possible to authenticate to the core API with a username and an SSH public key wit… |
CVE-2023-43650 | High | 8.2 | 2023-09-27 | JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to the absence of rate… |
CVE-2023-42442 | High | 8.2 | 2023-09-15 | JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3… |
CVE-2025-62795 | High | 7.1 | 2025-10-30 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.21-lts and v4.10.12-lts, a low-privileged auth… |
CVE-2023-42820 | High | 7.0 | 2023-09-27 | JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated… |
CVE-2026-31864 | Medium | 6.8 | 2026-03-13 | JumpServer is an open source bastion host and an operation and maintenance security audit system. a Server-Side Template Injection (SSTI) vulnerability exists… |
CVE-2025-58044 | Medium | 6.1 | 2025-12-01 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses… |
CVE-2023-28110 | Medium | 5.7 | 2023-03-16 | Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and We… |
CVE-2023-42818 | Medium | 5.4 | 2023-09-27 | JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding… |
CVE-2023-46123 | Medium | 5.3 | 2023-10-25 | jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specifications. A flaw in the… |
CVE-2026-31798 | Medium | 5.0 | 2026-03-13 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v4.10.16-lts, JumpServer improperly validates certif… |
CVE-2024-29024 | Medium | 4.6 | 2024-03-29 | JumpServer is an open source bastion host and an operation and maintenance security audit system. An authenticated user can exploit the Insecure Direct Object… |