CVE-2023-43651

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

JumpServer is an open source bastion host. An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary commands, leading to remote code execution. This vulnerability may further be leveraged to gain root privileges on the system. Through the WEB CLI interface provided by the koko component, a user logs into the authorized mongoDB database and exploits the MongoDB session to execute arbitrary commands. This vulnerability has been addressed in versions 2.28.20 and 3.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Sep 27, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-436529.1JumpServer is an open source bastion host. As an unauthenticated user, it is possible to authenticate to the core API with a username and anCVE-2023-436549.8TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, eCVE-2023-436558.8Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be CVE-2023-436569.0matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances that have enabled transfoCVE-2023-436576.1discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encrypted topic titles coCVE-2023-436586.1dicourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of CVE-2023-436595.4Discourse is an open source platform for community discussion. Improper escaping of user input allowed for Cross-site Scripting attacks via CVE-2023-43668.8Use after free in Extensions in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extensiCVE-2023-436608.1Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user cCVE-2023-436618.8Cachet is an open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allowsCVE-2023-436628.6ShokoServer is a media server which specializes in organizing anime. In affected versions the `/api/Image/WithPath` endpoint is accessible wCVE-2023-436634.3PrestaShop is an Open Source e-commerce web application. In affected versions any module can be disabled or uninstalled from back office, ev