CVE-2024-24763

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to version 3.10.0, attackers can exploit this vulnerability to construct malicious links, leading users to click on them, thereby facilitating phishing attacks or cross-site scripting attacks. Version 3.10.0 contains a patch for this issue. No known workarounds are available.

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v3.1

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

EPSS

1.06% chance of exploitation in the next 30 days, 62th percentile

Nuclei

medium · CWE-601

Published

2024-02-20

Updated

2024-08-01

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-24763.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2024-24762
• CVE-2024-24765
• CVE-2024-24760
• CVE-2024-24767
• CVE-2024-24759
• CVE-2024-24777