PT-2023-29870

CVE-2023-46138

Publicado

2023-10-30

Atualizado

2023-11-08

Descrição por

CVSS 3.1

3.7

Baixa

MétricasAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions JumpServer versions prior to 3.8.0

Description The issue concerns the default email address for the initial admin user, which is set to admin[@]mycompany[.]com. This could potentially affect password reset functionality if the domain mycompany.com is registered in the future. The estimated number of potentially affected devices is not specified.

Recommendations For versions prior to 3.8.0, update to version 3.8.0 or later. As a temporary workaround, consider changing the default email domain to example.com manually for those who cannot upgrade.

Explorabilidade

Exploit

Correção

Pesquisadores

Edwardzpeng

Kirualawliet

Zhiniang Peng

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-640: Weak Password Recovery Mechanism for Forgotten Password

Identificadores relacionados