Security

SECURITY.md

安全说明

JumpServer 是一款正在成长的安全产品，请参考基本安全建议部署安装.

如果你发现安全问题，请直接联系我们，我们携手让世界更好：

Security Policy

JumpServer is a security product, The installation and development should follow our security tips.

Reporting a Vulnerability

All security bugs should be reported to the contact as below:

Arbitrary File Read in Ansible Playbooks
GHSA-rpf7-g4xh-84v9 published Jul 18, 2024 by ibuler

Critical
Arbitrary File Write in Ansible Playbooks leads to RCE
GHSA-3wgp-q8m7-v33v published Jul 18, 2024 by ibuler

Critical
Insecure Ansible playbook validation leads to RCE in Celery
GHSA-pjpp-cm9x-6rwj published Mar 29, 2024 by ibuler

Critical
Jinja2 template injection in Ansible leads to RCE in Celery
GHSA-2vvr-vmvx-73ch published Mar 29, 2024 by ibuler

Critical
Insecure Direct Object Reference (IDOR) Vulnerability in File Manager Bulk Transfer Functionality
GHSA-8wqm-rfc7-q27q published Mar 29, 2024 by ibuler

Moderate
An authorized attacker can get sensitive information in playbook files when playbook_id is leaked
GHSA-7mqc-23hr-cr62 published Mar 29, 2024 by ibuler

Moderate
The Open Redirect Vulnerability
GHSA-p2mq-cm25-g4m5 published Feb 20, 2024 by ibuler

Moderate
Default admin user email leak to password reset
GHSA-9mrc-75cv-46cq published Oct 26, 2023 by ibuler

Low
Brute-force MFA verification with known public key on koko ssh connect
GHSA-97hj-xpgc-9ccw published Oct 23, 2023 by ibuler

Moderate
Password brute-force protection bypass via fake IP values
GHSA-hvw4-766m-p89f published Oct 24, 2023 by ibuler

Moderate

Learn more about advisories related to jumpserver/jumpserver in the GitHub Advisory Database