CVE-2023-48193 (GCVE-0-2023-48193)
Vulnerability from cvelistv5
Published
2023-11-28 00:00
Modified
2024-08-02 21:23
Severity ?
CWE
  • n/a
Summary
Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via bypassing the command filtering function. NOTE: this is disputed because command filtering is not intended to restrict what code can be run by authorized users who are allowed to execute files.
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T21:23:39.268Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/jumpserver/jumpserver"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://jumpserver.com"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/296430468/lcc_test/blob/main/jumpserver_BUG.md"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://blog.fit2cloud.com/?p=8cf83cd9-c23b-4625-9350-38926fb7f88e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/jumpserver/jumpserver/issues/13394"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via bypassing the command filtering function. NOTE: this is disputed because command filtering is not intended to restrict what code can be run by authorized users who are allowed to execute files."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-11T11:42:49.340350",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/jumpserver/jumpserver"
        },
        {
          "url": "http://jumpserver.com"
        },
        {
          "url": "https://github.com/296430468/lcc_test/blob/main/jumpserver_BUG.md"
        },
        {
          "url": "https://blog.fit2cloud.com/?p=8cf83cd9-c23b-4625-9350-38926fb7f88e"
        },
        {
          "url": "https://github.com/jumpserver/jumpserver/issues/13394"
        }
      ],
      "tags": [
        "disputed"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-48193",
    "datePublished": "2023-11-28T00:00:00",
    "dateReserved": "2023-11-13T00:00:00",
    "dateUpdated": "2024-08-02T21:23:39.268Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-48193\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2023-11-28T21:15:08.373\",\"lastModified\":\"2024-11-21T08:31:11.587\",\"vulnStatus\":\"Modified\",\"cveTags\":[{\"sourceIdentifier\":\"cve@mitre.org\",\"tags\":[\"disputed\"]}],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via bypassing the command filtering function. NOTE: this is disputed because command filtering is not intended to restrict what code can be run by authorized users who are allowed to execute files.\"},{\"lang\":\"es\",\"value\":\"La vulnerabilidad de permisos inseguros en JumpServer GPLv3 v.3.8.0 permite a un atacante remoto ejecutar c\u00f3digo arbitrario omitiendo la funci\u00f3n de filtrado de comandos.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fit2cloud:jumpserver:3.8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BEA14CBD-A40D-4DB1-B0F4-42E9C62A5B54\"}]}]}],\"references\":[{\"url\":\"http://jumpserver.com\",\"source\":\"cve@mitre.org\",\"tags\":[\"Product\"]},{\"url\":\"https://blog.fit2cloud.com/?p=8cf83cd9-c23b-4625-9350-38926fb7f88e\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://github.com/296430468/lcc_test/blob/main/jumpserver_BUG.md\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/jumpserver/jumpserver\",\"source\":\"cve@mitre.org\",\"tags\":[\"Product\"]},{\"url\":\"https://github.com/jumpserver/jumpserver/issues/13394\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://jumpserver.com\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Product\"]},{\"url\":\"https://blog.fit2cloud.com/?p=8cf83cd9-c23b-4625-9350-38926fb7f88e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/296430468/lcc_test/blob/main/jumpserver_BUG.md\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/jumpserver/jumpserver\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Product\"]},{\"url\":\"https://github.com/jumpserver/jumpserver/issues/13394\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.