CVE-2023-46123

Katalog CVE

CVSS 5.3 · Medium EPSS 0,71%

Kerentanan Improper Restriction of Excessive Authentication Attempts pada fit2cloud jumpserver. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specifications. A flaw in the Core API allows attackers to bypass password brute-force protections by spoofing arbitrary IP addresses. By exploiting this vulnerability, attackers can effectively make unlimited password attempts by altering their apparent IP address for each request. This vulnerability has been patched in version 3.8.0.

Rincian

Terbit di NVD

25 Oktober 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-307: Improper Restriction of Excessive Authentication Attempts

EPSS (30 hari)

0,71% peluang dieksploitasi; lebih tinggi dari 52,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jumpserver/jumpserver/security/advisories/GHSA-hvw4-766m-p89f exploit · advisory vendor
• https://github.com/jumpserver/jumpserver/releases/tag/v3.8.0 release notes
• https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-1-2