GitHub Advisoryadvisory · Packagist

GHSA-5p73-qg2v-383h LTI 1.3 Tool Library's Nonce Claim Value not validated against nonce value sent in Authentication Request before v5.0

HIGH Published 2022-07-15 Modified 2022-07-19 Official page ↗
Aliases
CVE-2022-31158
Ecosystem
Packagist
Packages
packbackbooks/lti-1-3-php-library
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-294, CWE-327
Reviewed
2022-07-15

Affected packages

• Packagist packbackbooks/lti-1-3-php-library: < 5.0 → fixed in 5.0

Description

Impact Nonce Claim Value was not being validated against the nonce value sent in the Authentication Request. Patches Users should upgrade to version 5.0 immediately Workarounds None.

Related

Alias · CVE (1)

  • CVE-2022-31158 LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. vulnerability

Weakness · CWE (2)

  • CWE-294 Authentication Bypass by Capture-replay weakness
  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness

References