critical9.8
CVE-2023-31579
Dromara Lamp-Cloud Use of Hard-coded Cryptographic Key
Impact
Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. This vulnerability allows attackers to authenticate to the application via a crafted JWT token.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | top.tangyh.basic:lamp-core | < 3.8.1 | 3.8.1 |
| maven | top.tangyh.basic:lamp-util | < 3.8.1 | 3.8.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tangyh | Lamp-Cloud | before 3.8.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/dromara/lamp-cloud/issues/183
- https://github.com/xubowenW/JWTissues/blob/main/lamp%20issue.md
- https://github.com/advisories/GHSA-xr8c-mq5x-5f56
- https://nvd.nist.gov/vuln/detail/CVE-2023-31579
- https://github.com/dromara/lamp-cloud/commit/31f79b122d85ed1b4f354673212692aa8205437a