Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
JumpServer allows nn authorized attacker to get sensitive information in playbook files when playbook_id is leaked
Vulnerability Description
JumpServer is an open source bastion host and an operation and maintenance security audit system. An authorized attacker can obtain sensitive information contained within playbook files if they manage to learn the playbook_id of another user. This breach of confidentiality can lead to information disclosure and exposing sensitive data. This vulnerability is fixed in v3.10.6.
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Vulnerability Type
通过用户控制密钥绕过授权机制
Vulnerability Title
JumpServer 安全漏洞
Vulnerability Description
JumpServer是中国杭州飞致云信息科技有限公司的一款开源堡垒机。 JumpServer v3.10.6之前版本存在安全漏洞，该漏洞源于如果授权攻击者设法了解其他用户的 playbook_id，则他们可以获取 playbook 文件中包含的敏感信息。
CVSS Information
N/A
Vulnerability Type
N/A