CVE-2025-62795 | THREATINT

Description

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.21-lts and v4.10.12-lts, a low-privileged authenticated user can invoke LDAP configuration tests and start LDAP synchronization by sending crafted messages to the /ws/ldap/ WebSocket endpoint, bypassing authorization checks and potentially exposing LDAP credentials or causing unintended sync operations. This vulnerability is fixed in v3.10.21-lts and v4.10.12-lts.

PUBLISHED Reserved 2025-10-22 | Published 2025-10-30 | Updated 2025-10-31 | Assigner GitHub_M

HIGH: 7.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Problem types

CWE-863: Incorrect Authorization

Product status

< 3.10.21-lts

affected

>= 4.0.0, < 4.10.12-lts

affected

References

github.com/...server/security/advisories/GHSA-7893-256g-m822 exploit

github.com/...server/security/advisories/GHSA-7893-256g-m822

cve.org (CVE-2025-62795)

nvd.nist.gov (CVE-2025-62795)

Download JSON