CVE-2024-29020

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

JumpServer is an open source bastion host and an operation and maintenance security audit system. An authorized attacker can obtain sensitive information contained within playbook files if they manage to learn the playbook_id of another user. This breach of confidentiality can lead to information disclosure and exposing sensitive data. This vulnerability is fixed in v3.10.6.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Mar 29, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-290219.0Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable to a sandbox escape CVE-2024-290228.8Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versio CVE-2024-290237.2Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens are CVE-2024-290245.3JumpServer is an open source bastion host and an operation and maintenance security audit system. An authenticated user can exploit the Inse CVE-2024-290255.3Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers CVE-2024-290269.1Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. In versions 0.1.2 and prior, a leni CVE-2024-290279.0Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 6.5.5 and 7.0.0-al CVE-2024-290285.3memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows CVE-2024-290296.1memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/image that allows una CVE-2024-29038.8A vulnerability was found in Tenda AC7 15.03.06.44. It has been classified as critical. Affected is the function GetParentControlInfo of the CVE-2024-290305.3memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /api/resource that allows au CVE-2024-290317.5Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications.