GitHub Advisoryadvisory · Maven

GHSA-xr8c-mq5x-5f56 Dromara Lamp-Cloud Use of Hard-coded Cryptographic Key

HIGH Published 2023-11-03 Modified 2023-11-03 Official page ↗
Aliases
CVE-2023-31579
Ecosystem
Maven
Packages
top.tangyh.basic:lamp-core, top.tangyh.basic:lamp-util
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-798
Reviewed
2023-11-03

Affected packages

• Maven top.tangyh.basic:lamp-core: < 3.8.1 → fixed in 3.8.1 • Maven top.tangyh.basic:lamp-util: < 3.8.1 → fixed in 3.8.1

Description

Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. This vulnerability allows attackers to authenticate to the application via a crafted JWT token.

Related

Alias · CVE (1)

  • CVE-2023-31579 Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. vulnerability

Weakness · CWE (1)

  • CWE-798 Use of Hard-coded Credentials weakness

References