CVE-2023-46138: JumpServer default admin user email leak password reset
JumpServer is an open source bastion host and maintenance security audit system that complies with 4A specifications. Prior to version 3.8.0, the default email for initial user admin is admin[@]mycompany[.]com, and users reset their passwords by sending an email. Currently, the domain mycompany.com has not been registered. However, if it is registered in the future, it may affect the password reset functionality. This issue has been patched in version 3.8.0 by changing the default email domain to example.com. Those who cannot upgrade may change the default email domain to example.com manually.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-46138.
What is the severity of CVE-2023-46138?
The severity of CVE-2023-46138 is medium with a severity value of 5.3.
What is affected by CVE-2023-46138?
JumpServer prior to version 3.8.0 is affected by CVE-2023-46138.
How can I fix CVE-2023-46138?
To fix CVE-2023-46138, upgrade to version 3.8.0 or higher of JumpServer.
Where can I find more information about CVE-2023-46138?
You can find more information about CVE-2023-46138 at the following references: [GitHub Advisory](https://github.com/jumpserver/jumpserver/security/advisories/GHSA-9mrc-75cv-46cq), [GitHub Commit](https://github.com/jumpserver/jumpserver/commit/15a5dda9e0cdbe2ac618a6b2a09df8928f485c88).