JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to version 3.10.0, attackers can exploit this vulnerability to construct malicious links, leading users to click on them, thereby facilitating phishing attacks or cross-site scripting attacks. Version 3.10.0 contains a patch for this issue. No known workarounds are available.
References
| Link | Resource |
|---|---|
| https://github.com/jumpserver/jumpserver/releases/tag/v3.10.0 | Release Notes |
| https://github.com/jumpserver/jumpserver/releases/tag/v3.10.0 | Release Notes |
| https://github.com/jumpserver/jumpserver/security/advisories/GHSA-p2mq-cm25-g4m5 | Vendor Advisory |
| https://github.com/jumpserver/jumpserver/security/advisories/GHSA-p2mq-cm25-g4m5 | Vendor Advisory |
Configurations
History
17 Dec 2024, 20:03
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-601 | |
| First Time |
Fit2cloud
Fit2cloud jumpserver |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| CPE | cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:* | |
| References | () https://github.com/jumpserver/jumpserver/security/advisories/GHSA-p2mq-cm25-g4m5 - Vendor Advisory | |
| References | () https://github.com/jumpserver/jumpserver/releases/tag/v3.10.0 - Release Notes |
20 Feb 2024, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-02-20 18:15
Updated : 2024-12-17 20:03
NVD link : CVE-2024-24763
Mitre link : CVE-2024-24763
JSON object : View
Products Affected
fit2cloud
- jumpserver
CWE
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')