Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-48193: JumpServer 3.8.0 allows remote code execution via bypassed command filtering

CVE-2023-48193 · published 2 years ago

Summary

A vulnerability in JumpServer version 3.8.0 allows a malicious user to execute unauthorized code on a remote system. This could potentially allow an attacker to access sensitive information or disrupt system operations. IT administrators should review their JumpServer configurations to ensure proper permissions and access controls are in place.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
fit2cloud	jumpserver	3.8.0 `cpe:2.3:a:fit2cloud:jumpserver:3.8.0:::::::*`

Original advisory text

Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via bypassing the command filtering function. NOTE: this is disputed because command filtering is not intended to restrict what code can be run by authorized users who are allowed to execute files.

References

http://jumpserver.com Product
https://github.com/296430468/lcc_test/blob/main/jumpserver_BUG.md URL
https://github.com/jumpserver/jumpserver/issues/13394 Third Party Advisory
https://github.com/jumpserver/jumpserver Product
https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48193... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-48193 Vendor Advisory
https://blog.fit2cloud.com/?p=8cf83cd9-c23b-4625-9350-38926fb7f88e Third Party Advisory

Severity

9.8 Critical

Exploitation

2% chance of attack within 30 days

Timeline

Published28 Nov 2023

Updated4 Nov 2026

First seen5 Jul 2026

Sources

CVE-2023-48193 · NVD

CVE-2023-48193 · MITRE

CVE-2023-48193 · OSV

Track software like this

Free during beta