GitHub Advisoryadvisory · NuGet

GHSA-mj5w-w588-j6xg Use of Hard-coded Credentials in AgileConfig.Client

CRITICAL Published 2022-08-19 Modified 2022-08-30 Official page ↗

Aliases: CVE-2022-35540
Ecosystem: NuGet
Packages: AgileConfig.Client
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-798
Reviewed: 2022-08-30

Affected packages

• NuGet AgileConfig.Client: < 1.6.8 → fixed in 1.6.8

Description

Hardcoded JWT Secret in AgileConfig <1.6.8 Server allows remote attackers to use the generated JWT token to gain administrator access.

Related

Alias · CVE (1)

CVE-2022-35540 Hardcoded JWT Secret in AgileConfig <1.6.8 Server allows remote attackers to use the generated JWT token to gain administrator access. vulnerability

Weakness · CWE (1)

CWE-798 Use of Hard-coded Credentials weakness

References