#VU128124 Improper access control in JumpServer - CVE-2024-40629
Published: July 18, 2024 / Updated: April 27, 2026
Vulnerability identifier: #VU128124
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2024-40629
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
JumpServer
JumpServer
Software vendor:
JumpServer
JumpServer
Description
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper access control in the Ansible playbook feature when creating and running playbook templates through the Job Center. A remote user can write arbitrary files in the Celery container to execute arbitrary code.
Exploitation requires access to at least one host and access to the Job Center feature. The Celery container runs as root and has database access.
Remediation
Install security update from vendor's website.