CVE-2025-27095

MEDIUM Year: 2025
CVSS v3 Score
4.3
Medium
Weakness Type
CWE-266
View all →

Vulnerability Description

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.8.0 and 3.10.18, an attacker with a low-privileged account can access the Kubernetes session feature and manipulate the kubeconfig file to redirect API requests to an external server controlled by the attacker. This allows the attacker to intercept and capture the Kubernetes cluster token. This can potentially allow unauthorized access to the cluster and compromise its security. This vulnerability is fixed in 4.8.0 and 3.10.18.

Related Vulnerabilities

CVE-2020-14318

MEDIUM
CVSS:4.3(Medium)

A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and directory information which otherwise would be un...

CWE-2662020

CVE-2021-1303

MEDIUM
CVSS:4.3(Medium)

A vulnerability in the user management roles of Cisco DNA Center could allow an authenticated, remote attacker to execute unauthorized commands on an affected device. The vulnerability is due to impro...

CWE-2662021

CVE-2021-1416

MEDIUM
CVSS:4.3(Medium)

Multiple vulnerabilities in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information. These vulnerabilities are due to imp...

CWE-2662021

CVE-2021-36097

MEDIUM
CVSS:4.3(Medium)

Agents are able to lock the ticket without the "Owner" permission. Once the ticket is locked, it could be moved to the queue where the agent has "rw" permissions and gain a full control. This issue af...

CWE-2662021

CVE-2024-11486

MEDIUM
CVSS:4.3(Medium)

A vulnerability, which was classified as problematic, was found in Code4Berry Decoration Management System 1.0. This affects an unknown part of the file /decoration/admin/user_permission.php of the co...

CWE-2662024

CVE-2024-49348

MEDIUM
CVSS:4.3(Medium)

IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 allows restricting access to organizational dat...

CWE-2662024