Cyber Resilience

CVE-2023-28110

MediumPublic PoCRCE

Published: 16 March 2023

Published
16 March 2023
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 5.7 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H
EPSS Score 0.0145 81.2th percentile
Risk Priority 12 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-28110 is a medium-severity Command Injection (CWE-77) vulnerability in Fit2Cloud Jumpserver. Its CVSS base score is 5.7 (Medium).

Operationally, ranked in the top 18.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and Web Terminal service. Prior to version 2.28.8, using illegal tokens to connect to a…

more

Kubernetes cluster through Koko can result in the execution of dangerous commands that may disrupt the Koko container environment and affect normal usage. The vulnerability has been fixed in v2.28.8.

CWE(s)
CWE-77

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

fit2cloud
jumpserver
≤ 2.28.8
fit2cloud
koko
all versions

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References