VulnerabilityModified

CVE-2023-42442

SessionViewSet permission classes set to `[RBACPermission | IsSessionAssignee]`, relation is or, so any permission matched will be allowed.

MEDIUM 5.3EPSS 63.0%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 63.0%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not affected. The api `/api/v1/terminal/sessions/` permission control is broken and can be accessed anonymously. SessionViewSet permission classes set to `[RBACPermission | IsSessionAssignee]`, relation is or, so any permission matched will be allowed. Versions 3.5.5 and 3.6.4 have a fix. After upgrading, visit the api `$HOST/api/v1/terminal/sessions/?limit=1`. The expected http response code is 401 (`not_authenticated`).

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: 63.03% probability · 99th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-287
Affected: fit2cloud/jumpserver
Source: security-advisories@github.com

EPSS trend

EPSS moved from 63.0% on 7 October 2026 to 63.0% on 3 November 2026. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”.

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.