← Vulnerability feed

Vulnerability record · CVE-2023-42442 · published 15 September 2023

CVE-2023-42442: JumpServer session replay API allows unauthenticated access

Fit2cloud · Jumpserver

JumpServer versions 3.0.0 through 3.5.4 and 3.6.0 through 3.6.3 expose the session replay API endpoint /api/v1/terminal/sessions/ without requiring authentication. The SessionViewSet permission classes use an OR relationship between RBACPermission and IsSessionAssignee, so any matching permission grants access, and anonymous requests are allowed. This lets anyone retrieve recorded session data, which often contains sensitive operational activity.

5.3 CVSS 3.1 Medium EPSS 59% · top 0.9% CWE-287 · Improper authentication
5.3CVSS 3.1 base score
59%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not affected. The api `/api/v1/terminal/sessions/` permission control is broken and can be accessed anonymously. SessionViewSet permission classes set to `[RBACPermission | IsSessionAssignee]`, relation is or, so any permission matched will be allowed. Versions 3.5.5 and 3.6.4 have a fix. After upgrading, visit the api `$HOST/api/v1/terminal/sessions/?limit=1`. The expected http response code is 401 (`not_authenticated`).

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityThe endpoint is remotely reachable without authentication, the vendor advisory is tagged Exploit, and EPSS is very high, though the CVSS score is only medium.

What it is

JumpServer versions 3.0.0 through 3.5.4 and 3.6.0 through 3.6.3 expose the session replay API endpoint /api/v1/terminal/sessions/ without requiring authentication. The SessionViewSet permission classes use an OR relationship between RBACPermission and IsSessionAssignee, so any matching permission grants access, and anonymous requests are allowed. This lets anyone retrieve recorded session data, which often contains sensitive operational activity.

Impact

An unauthenticated attacker can download session replay recordings, exposing credentials, commands, and data viewed during privileged sessions. The CVSS confidentiality impact is low, but the content of bastion session recordings can be highly sensitive.

Attack surface

The flaw is reachable over the network via the HTTP API endpoint /api/v1/terminal/sessions/ with no authentication and no user interaction required. Session replays stored in S3, OSS, or other cloud storage are not affected.

Exploitation

The vendor advisory is tagged Exploit, and EPSS is 0.58538 (99th percentile), indicating a high likelihood of exploitation activity. CISA KEV does not list this CVE.

What to do

  • Upgrade JumpServer to version 3.5.5 or 3.6.4, which contain the fix.
  • After upgrading, verify the endpoint returns HTTP 401 by requesting $HOST/api/v1/terminal/sessions/?limit=1.
  • If immediate upgrade is not possible, restrict network access to the JumpServer API to trusted management networks only.
  • Review access logs for anonymous or unexpected requests to /api/v1/terminal/sessions/ and treat any successful retrieval as a potential data exposure.

Detection

  • Monitor web access logs for requests to /api/v1/terminal/sessions/ that return HTTP 200 without an authenticated session.
  • Alert on anonymous or unauthenticated access to session replay endpoints, especially bulk or repeated requests.
  • Audit JumpServer API logs for session replay downloads from IP addresses outside expected administrator ranges.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/jumpserver/jumpserver/blob/v3.6.1/apps/terminal/api/session/session.py#L91 Product
https://github.com/jumpserver/jumpserver/commit/0a58bba59cd275bab8e0ae58bf4b359fbc5eb74a Patch
https://github.com/jumpserver/jumpserver/security/advisories/GHSA-633x-3f4f-v9rw ExploitVendor Advisory
https://github.com/jumpserver/jumpserver/blob/v3.6.1/apps/terminal/api/session/session.py#L91 Product
https://github.com/jumpserver/jumpserver/commit/0a58bba59cd275bab8e0ae58bf4b359fbc5eb74a Patch
https://github.com/jumpserver/jumpserver/security/advisories/GHSA-633x-3f4f-v9rw ExploitVendor Advisory

Track CVE-2023-42442 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2024-29202Fit2cloud jumpserver code injection vulnerabilityJumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template injection v…EPSS 5.9%9.9CVE-2024-29201Fit2cloud jumpserver code injection vulnerabilityJumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism…EPSS 5.9%9.9CVE-2023-43651Fit2cloud jumpserver code injection vulnerabilityJumpServer is an open source bastion host. An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary commands, leadi…EPSS 1.7%9.9CVE-2023-28110Fit2cloud jumpserver command injection vulnerabilityJumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP serv…EPSS 0.85%9.8CVE-2024-40629Fit2cloud jumpserver path traversal vulnerabilityJumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, …EPSS 1.3%9.8CVE-2023-48193Fit2cloud jumpserver vulnerabilityInsecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via bypassing the command filtering…EPSS 2.0%9.8CVE-2023-42818Fit2cloud jumpserver improper authentication vulnerabilityJumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the cor…EPSS 0.58%9.1CVE-2024-40628Fit2cloud jumpserver path traversal vulnerabilityJumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, …EPSS 0.86%

Source: NIST National Vulnerability Database (record CVE-2023-42442), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.