CVE-2024-24763

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to version 3.10.0, attackers can exploit this vulnerability to construct malicious links, leading users to click on them, thereby facilitating phishing attacks or cross-site scripting attacks. Version 3.10.0 contains a patch for this issue. No known workarounds are available.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

VendorProductVersions
jumpserverjumpserver< 3.10.0

References

Timeline

Published
Feb 20, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-247644.8October is a self-hosted CMS platform based on the Laravel PHP Framework. This issue affects authenticated administrators who may be redirecCVE-2024-247659.8CasaOS-UserService provides user management functionalities to CasaOS. Prior to version 0.4.7, path filtering of the URL for user avatar imaCVE-2024-247667.5CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS LCVE-2024-247679.8CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn'CVE-2024-247687.51Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have tCVE-2024-247692.1vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, users can reset their MFA token via API rCVE-2024-24775.4The wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Alternative Text' field of an uploaded image in all CVE-2024-247705.3vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-ParCVE-2024-247715.9Open Forms allows users create and publish smart forms. Versions prior to 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain a non-exploitable multi-facCVE-2024-247724.3A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying CVE-2024-247736.5Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue afCVE-2024-247744.1Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who creat