References https://cloud.tencent.com/developer/article/2332248 https://blog.fit2cloud.com/?p=8cf83cd9-c23b-4625-9350-38926fb7f88e https://blog.csdn.net/WangsuSecurity/article/details/135847589 https://developer.aliyun.com/article/1332088 https://www.secrss.com/articles/59284 https://www.h3c.com/cn/d_202310/1949406_30003_0.htm https://stack.chaitin.com/techblog/detail/156 https://www.leavesongs.com/PENETRATION/jumpserver-sep-2023-multiple-vulnerabilities-go-through.html https://zhuanlan.zhihu.com/p/657861765 https://blog.nsfocus.net/jumpservercve-2023-42442/ https://www.cnblogs.com/fuchangjiang/p/17713181.html https://github.com/jumpserver/jumpserver/security/advisories/GHSA-633x-3f4f-v9rw
Related VulnerabilitiesPoCCVE-2025-58044: JumpServer - Open Redirect via Referer Header(CVE-2025-62712) JumpServer ConnectionToken 权限验证不当漏洞PoCCVE-2023-42442: JumpServer > 3.6.4 - Information DisclosurePoCCVE-2024-24763: JumpServer < 3.10.0 - Open RedirectPoCCVE-2023-42442: JumpServer 未授权访问PoCjumpserver-unauth-rce: Jumpserver Unauth RCE飞致云 JumpServer 需授权 任意文件读取漏洞JumpServer 需授权 文件写入漏洞JumpServer CVE-2024-29201 远程代码执行漏洞JumpServer 远程代码执行漏洞JumpServer CVE-2024-29202 远程代码执行漏洞JumpServer CoreAPI CVE-2023-43652 身份认证绕过漏洞