CVE-2023-46123

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specifications. A flaw in the Core API allows attackers to bypass password brute-force protections by spoofing arbitrary IP addresses. By exploiting this vulnerability, attackers can effectively make unlimited password attempts by altering their apparent IP address for each request. This vulnerability has been patched in version 3.8.0.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-307

Affected software

No affected versions have been published.

Timeline

Published: Oct 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-461247.2Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, and the CVE-2023-461256.5Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the CVE-2023-461265.4Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, helping CVE-2023-461275.4Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A ma CVE-2023-461286.5Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. I CVE-2023-461297.5NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge compu CVE-2023-46139.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not re CVE-2023-461305.4Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the CVE-2023-461317.5Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM CVE-2023-461326.5Hyperledger Fabric is an open source permissioned distributed ledger framework. Combining two molecules to one another, called "cross-linkin CVE-2023-461339.1CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times wea CVE-2023-461349.8D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to version 3.7.0, users