CVE-2023-42818: fit2cloud jumpserver

csirt@kutim:~/threat-intel/cve/CVE-2023-42818

CVSS 9.8 · Critical EPSS 0,68%

Kerentanan Improper Authentication pada fit2cloud jumpserver. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding SSH private key. An attacker could exploit a vulnerability by utilizing a disclosed public key to attempt brute-force authentication against the SSH service This issue has been patched in versions 3.6.5 and 3.5.6. Users are advised to upgrade. There are no known workarounds for this issue.

Rincian

Terbit di NVD: 27 September 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-287: Improper Authentication
CWE-307: Improper Restriction of Excessive Authentication Attempts
EPSS (30 hari): 0,68% peluang dieksploitasi; lebih tinggi dari 50,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
fit2cloud	jumpserver	Semua versi sebelum 3.5.6
fit2cloud	jumpserver	Versi 3.6.0 hingga sebelum 3.6.5

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.