Skip to content
OpenAdvisories

Package · Go

github.com/jumpserver/koko

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 5.4
    CVE-2023-42818

    SSH public key login without private key challenge if mfa is enabled in jumpserver

    JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding SSH private key. An attacker could exploit a vulnerability by utilizing a disclosed public key to a…

    jumpserver jumpserver github.com/jumpserver/koko github.com/jumpserver/jumpserver Go
  • High 8.6
    CVE-2023-43651

    Remote code execution on the host system via MongoDB shell in jumpserver

    JumpServer is an open source bastion host. An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary commands, leading to remote code execution. This vulnerability may further be leveraged to gain root privileges on the system…

    jumpserver jumpserver github.com/jumpserver/koko Go