JumpServer Direct Object Reference (IDOR) Vulnerability in File Manager Bulk Transfer Functionality
Priority MEDIUM 57CWE-639Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-639.
Summary
JumpServer is an open source bastion host and an operation and maintenance security audit system. An authenticated user can exploit the Insecure Direct Object Reference (IDOR) vulnerability in the file manager's bulk transfer by manipulating job IDs to upload malicious files, potentially compromising the integrity and security of the system. This vulnerability is fixed in v3.10.6.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00235 14th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jumpserver | jumpserver | 3.0.0 – 3.10.5 | — | No fix listed | CNA |
- jumpserver Vendorjumpserver Affected 3.0.0 – 3.10.5 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:* | 3.0.0 to before 3.10.6 | Vulnerable | 1Panel-dev |
- cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.10.6 Vulnerable ·1Panel-dev
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-29024
References
More jumpserver vulnerabilities
- TI-2024-27040 Arbitrary File Read in Ansible Playbooks in Jumpserver CVSS 3.1CRITICAL 10.0
- TI-2023-23378 Non-MFA account takeover via using only SSH public key to login in jumpserver CVSS 3.1CRITICAL 9.1
- TI-2023-22607 JumpServer session replays download without authentication CVSS 3.1HIGH 8.2
- TI-2024-27041 Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver CVSS 3.1CRITICAL 10.0
- TI-2024-19371 JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery CVSS 3.1CRITICAL 10.0
- TI-2024-19370 JumpServer's insecure Ansible playbook validation leads to RCE in Celery CVSS 3.1CRITICAL 10.0
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences