CVE-2023-42442

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-42442
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-42442.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-42442
Aliases
  • GHSA-633x-3f4f-v9rw
Published
2023-09-15T20:29:12.166Z
Modified
2025-11-19T17:34:42.431566Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H CVSS Calculator
Summary
JumpServer session replays download without authentication
Details

JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not affected. The api /api/v1/terminal/sessions/ permission control is broken and can be accessed anonymously. SessionViewSet permission classes set to [RBACPermission | IsSessionAssignee], relation is or, so any permission matched will be allowed. Versions 3.5.5 and 3.6.4 have a fix. After upgrading, visit the api $HOST/api/v1/terminal/sessions/?limit=1. The expected http response code is 401 (not_authenticated).

Database specific 
{
    "cwe_ids": [
        "CWE-287"
    ]
}
References

Affected packages

Git / github.com/jumpserver/jumpserver

Affected ranges

Type
GIT
Repo
https://github.com/jumpserver/jumpserver
Events
Introduced
7d3eb8c75d7edeb1cca3da25ae435acf678c4f69
Fixed
3a18f34e15d0c1fafdcad2fcdd30baec431d24c3
Database specific 
{
    "versions": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.5.5"
        }
    ]
}
Type
GIT
Repo
https://github.com/jumpserver/jumpserver
Events
Introduced
cb11cb17742377ea9baba8d9d4301306b9de7f51
Fixed
dd652681d3c5465abc92394d0336ddfa149f173b
Database specific 
{
    "versions": [
        {
            "introduced": "3.6.0"
        },
        {
            "fixed": "3.6.4"
        }
    ]
}