PT-2022-26693 · Unknown · Anji-Plus Aj-Report

Johnson · Published 2022-10-17 · Updated 2024-08-08 · CVE-2022-42983

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions anji-plus AJ-Report version 0.9.8.6

Description The issue allows remote attackers to bypass login authentication by spoofing JWT Tokens. This can be exploited by attackers to gain unauthorized access to the system.

Recommendations For anji-plus AJ-Report version 0.9.8.6, consider disabling the use of JWT Tokens for login authentication until a patch is available. Restrict access to sensitive areas of the application to minimize the risk of exploitation. Avoid using the token variable in authentication processes until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2022-42983

Affected Products

Anji-Plus Aj-Report

References · 6

• 🔥 https://github.com/anji-plus/report/issues/7 · Exploit
• 🔥 https://gitee.com/anji-plus/report/issues/I5VVZ0 · Exploit
• https://osv.dev/vulnerability/CVE-2022-42983 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-42983 · Security Note
• https://t.me/cvenotify/89895 · Telegram Post
• https://t.me/cibsecurity/51544 · Telegram Post