JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.21-lts and v4.10.12-lts, a low-privileged authenticated user can invoke LDAP configuration tests and start LDAP synchronization by sending crafted messages to the /ws/ldap/ WebSocket endpoint, bypassing authorization checks and potentially exposing LDAP credentials or causing unintended sync operations. This vulnerability is fixed in v3.10.21-lts and v4.10.12-lts.
References
| Link | Resource |
|---|---|
| https://github.com/jumpserver/jumpserver/security/advisories/GHSA-7893-256g-m822 | Exploit Vendor Advisory |
| https://github.com/jumpserver/jumpserver/security/advisories/GHSA-7893-256g-m822 | Exploit Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
12 Nov 2025, 15:26
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:* | |
| References | () https://github.com/jumpserver/jumpserver/security/advisories/GHSA-7893-256g-m822 - Exploit, Vendor Advisory | |
| First Time |
Fit2cloud
Fit2cloud jumpserver |
31 Oct 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/jumpserver/jumpserver/security/advisories/GHSA-7893-256g-m822 - |
30 Oct 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-30 17:15
Updated : 2025-11-12 15:26
NVD link : CVE-2025-62795
Mitre link : CVE-2025-62795
CVE.ORG link : CVE-2025-62795
JSON object : View
Products Affected
fit2cloud
- jumpserver
CWE
CWE-863
Incorrect Authorization