What is GHSA-xr8c-mq5x-5f56?

GHSA-xr8c-mq5x-5f56 is a security advisory published by GitHub Security Advisories with High severity. Dromara Lamp-Cloud Use of Hard-coded Cryptographic Key

Which CVE IDs does GHSA-xr8c-mq5x-5f56 cover?

GHSA-xr8c-mq5x-5f56 covers the following CVE IDs: CVE-2023-31579. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xr8c-mq5x-5f56?

GHSA-xr8c-mq5x-5f56 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-xr8c-mq5x-5f56?

GHSA-xr8c-mq5x-5f56 affects 2 products, including: maven/top.tangyh.basic:lamp-core:\u003c 3.8.1; maven/top.tangyh.basic:lamp-util:\u003c 3.8.1.

GHSA-xr8c-mq5x-5f56HighCVSS 7.5

Dromara Lamp-Cloud Use of Hard-coded Cryptographic Key

Vendor

GitHub Security Advisories

Published

November 3, 2023

Last Modified

November 9, 2023

🔗 CVE IDs covered (1)

CVE-2023-31579 →

📋 Description

Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. This vulnerability allows attackers to authenticate to the application via a crafted JWT token.

🎯 Affected products2

maven/top.tangyh.basic:lamp-core:< 3.8.1
maven/top.tangyh.basic:lamp-util:< 3.8.1

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2023-31579
https://github.com/dromara/lamp-cloud/issues/183
https://github.com/xubowenW/JWTissues/blob/main/lamp%20issue.md
https://github.com/dromara/lamp-cloud/commit/31f79b122d85ed1b4f354673212692aa8205437a
https://github.com/advisories/GHSA-xr8c-mq5x-5f56