// For flags

CVE-2023-43650

Non-MFA account takeover via brute-force attack on weak password reset code in jumpserver

Severity Score

7.4
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to the absence of rate limiting. JumpServer provides a feature allowing users to reset forgotten passwords. Affected users are sent a 6-digit verification code, ranging from 000000 to 999999, to facilitate the password reset. Although the code is only available in 1 minute, this window potentially allows for up to 1,000,000 validation attempts. This issue has been addressed in versions 2.28.20 and 3.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

JumpServer es un host de bastionado de código abierto. El código de verificación para restablecer la contraseña del usuario es vulnerable a ataques de fuerza bruta debido a la ausencia de rate limiting. JumpServer proporciona una función que permite a los usuarios restablecer contraseñas olvidadas. Los usuarios afectados reciben un código de verificación de 6 dígitos, que va del 000000 al 999999, para facilitar el restablecimiento de la contraseña. Aunque el código sólo está disponible en 1 minuto, esta ventana permite potencialmente hasta 1.000.000 de intentos de validación. Este problema se solucionó en las versiones 2.28.20 y 3.7.1. Se recomienda a los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
None
Automatable
Yes
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2023-09-20 CVE Reserved
  • 2023-09-27 CVE Published
  • 2024-09-23 CVE Updated
  • 2024-09-23 First Exploit
  • 2024-10-29 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-640: Weak Password Recovery Mechanism for Forgotten Password
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Fit2cloud
Search vendor "Fit2cloud"
 Jumpserver
Search vendor "Fit2cloud" for product "Jumpserver"
 >= 2.0.0 < 2.28.20
Search vendor "Fit2cloud" for product "Jumpserver" and version " >= 2.0.0 < 2.28.20"
-
Affected
Fit2cloud
Search vendor "Fit2cloud"
 Jumpserver
Search vendor "Fit2cloud" for product "Jumpserver"
 >= 3.0.0 < 3.7.1
Search vendor "Fit2cloud" for product "Jumpserver" and version " >= 3.0.0 < 3.7.1"
-
Affected