Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS14cjhjLW1xNXgtNWY1Ns4AA25D

Dromara Lamp-Cloud Use of Hard-coded Cryptographic Key

Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. This vulnerability allows attackers to authenticate to the application via a crafted JWT token.

Permalink: https://github.com/advisories/GHSA-xr8c-mq5x-5f56
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14cjhjLW1xNXgtNWY1Ns4AA25D
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 1 year ago
Updated: about 1 year ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Percentage: 0.00139
EPSS Percentile: 0.50521

Identifiers: GHSA-xr8c-mq5x-5f56, CVE-2023-31579
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-31579
• https://github.com/dromara/lamp-cloud/issues/183
• https://github.com/xubowenW/JWTissues/blob/main/lamp%20issue.md
• https://github.com/dromara/lamp-cloud/commit/31f79b122d85ed1b4f354673212692aa8205437a
• https://github.com/advisories/GHSA-xr8c-mq5x-5f56

Repository: https://github.com/dromara/lamp-cloud
Blast Radius: 9.2

Affected Packages