critical9.8
CVE-2022-35540
Use of Hard-coded Credentials in AgileConfig.Client
Impact
Hardcoded JWT Secret in AgileConfig <1.6.8 Server allows remote attackers to use the generated JWT token to gain administrator access.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | AgileConfig.Client | < 1.6.8 | 1.6.8 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dotnetcore | Agileconfig | before 1.6.8 |