CVE-2024-29201
JumpServer's insecure Ansible playbook validation leads to RCE in Celery
Vexday Risk Score
28Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 10EPSS 5.9%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
29 mar 2024Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database. This vulnerability is fixed in v3.10.7.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Productos afectados
jumpserver · jumpserver¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →