Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0zajJmLTU4cnEtZzZwN84AA2o5

Sureness uses hardcoded key

Dromara Sureness before v1.0.8 was discovered to use a hardcoded key.

Permalink: https://github.com/advisories/GHSA-3j2f-58rq-g6p7
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zajJmLTU4cnEtZzZwN84AA2o5
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: about 1 year ago
Updated: about 1 year ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Percentage: 0.00176
EPSS Percentile: 0.55806

Identifiers: GHSA-3j2f-58rq-g6p7, CVE-2023-31581
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-31581
• https://github.com/dromara/sureness/issues/164
• https://github.com/xubowenW/JWTissues/blob/main/sureness%20secure%20issues.md
• https://github.com/dromara/sureness/commit/12987a72cbf1eabbca1e308ed1fe9445958aeca7
• https://github.com/advisories/GHSA-3j2f-58rq-g6p7

Repository: https://github.com/dromara/sureness
Blast Radius: 10.9

Affected Packages