CVE-2023-48193
Critical · CVSS 9.8JumpServer — Insecure Permissions / Command Filter Bypass RCE
- CVSS
- 9.8
- nvd
- EPSS
- 1.96%
- 78th pct
- KEV
- No
- Class
- oss containerizable
- NVD-CWE-noinfo
Description
Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via bypassing the command filtering function. NOTE: this is disputed because command filtering is not intended to restrict what code can be run by authorized users who are allowed to execute files.
Search profile — drives PoC discovery
Symbols command filteringcommand filter bypassjumpserver_BUG.mdGPLv3execute arbitrary codebypassing the command filtering functionissues/13394
Keywords CVE-2023-48193JumpServercommand filter bypassRCEarbitrary code executionJumpServer 3.8.0insecure permissionsjumpserver command filtering bypassjumpserver PoCjumpserver exploit
Versions: v3.8.0
Ranked PoCs (2) — best first
Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.
- ★ 0
- ★ 0cyb3r-w0lf/nuclei-template-collection needs reviewtrickest
Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.
References
- https://blog.fit2cloud.com/?p=8cf83cd9-c23b-4625-9350-38926fb7f88e
- https://github.com/296430468/lcc_test/blob/main/jumpserver_BUG.md
- https://github.com/jumpserver/jumpserver
- https://github.com/jumpserver/jumpserver/issues/13394
- http://jumpserver.com
- https://blog.fit2cloud.com/?p=8cf83cd9-c23b-4625-9350-38926fb7f88e
- https://github.com/296430468/lcc_test/blob/main/jumpserver_BUG.md
- https://github.com/jumpserver/jumpserver
- https://github.com/jumpserver/jumpserver/issues/13394
Status: enriched · ingested 2026-07-05T18:00:39.000Z · profiled 2026-07-05T18:30:39.000Z