Description (CNA)
An issue in Jumpserver before 2.6.2, before 2.5.4, before 2.4.5 allows attackers to create a connection token through an API which does not have access control and use it to access sensitive assets.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- https://mp.weixin.qq.com/s/5tgcaIrnDnGP-LvWPw9YCg
- https://s.tencent.com/research/bsafe/1228.html
- https://blog.fit2cloud.com/?p=1764
ADP enrichment
No English description supplied.