CVE-2024-29202

Katalog CVE

CVSS 9.9 · Critical EPSS 5,9%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada fit2cloud jumpserver. Skor CVSS 3.1 9.9 (Critical) menurut NVD.

Deskripsi (NVD)

JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template injection vulnerability in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database. This vulnerability is fixed in v3.10.7.

Rincian

Terbit di NVD

29 Maret 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.9 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

5,9% peluang dieksploitasi; lebih tinggi dari 93,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jumpserver/jumpserver/security/advisories/GHSA-2vvr-vmvx-73ch exploit · advisory vendor
• https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-2-2