CVE-2023-48193
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk78th percentile - higher than 78% of all known CVEs
Summary
A vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to bypass command filtering and execute arbitrary code. Note that the vendor disputes this, stating that command filtering is not intended to restrict authorized users.
Risk Assessment
The risk involves potential unauthorized code execution by an attacker, which could compromise system integrity and confidentiality.
Recommendation
It is recommended to update JumpServer to the latest version and review permission and command filtering configurations.
Original NVD description (English source)
Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via bypassing the command filtering function. NOTE: this is disputed because command filtering is not intended to restrict what code can be run by authorized users who are allowed to execute files.