ID:10448 - Exploit for Improper Authentication in JumpServer - CVE-2023-42442

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to the session replays can be downloaded without authentication within the /api/v1/terminal/sessions/ API. A remote attacker can bypass authentication process and perform a denial of service (DoS) attack.

Remediation