PT-2023-23396 · Unknown · Light-Oauth2

Kanixbo · Publicado 2023-10-24 · Atualizado 2023-10-31 · CVE-2023-31580

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions light-oauth2 versions prior to 2.1.27

Description The issue allows attackers to authenticate to the application with a crafted JWT token because the public key is obtained without verification.

Recommendations For versions prior to 2.1.27, update to version 2.1.27 or later to resolve the issue.

Exploit

Correção

Improper Certificate Validation

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-295

CWE-347

Identificadores relacionados

CVE-2023-31580

GHSA-MX47-H5FV-GHWH

Produtos afetados

Light-Oauth2

Referências · 7

• 🔥 https://github.com/KANIXB/JWTIssues/blob/main/Certification%20Verification%20issue%20in%20light-oauth2.md · Exploit
• https://github.com/networknt/light-oauth2 · Nota
• https://github.com/networknt/light-oauth2/issues/369 · Nota
• https://twitter.com/CVEnew/status/1716945050771271861 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-31580 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-31580 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-mx47-h5fv-ghwh · Aviso do Fabricante