critical9.8
CVE-2023-31581
Sureness uses hardcoded key
Impact
Dromara Sureness before v1.0.8 was discovered to use a hardcoded key.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.usthe.sureness:sureness-core | < 1.0.8 | 1.0.8 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dromara | Sureness | before 1.0.8 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/dromara/sureness/issues/164
- https://github.com/xubowenW/JWTissues/blob/main/sureness%20secure%20issues.md
- https://github.com/advisories/GHSA-3j2f-58rq-g6p7
- https://nvd.nist.gov/vuln/detail/CVE-2023-31581
- https://github.com/dromara/sureness/commit/12987a72cbf1eabbca1e308ed1fe9445958aeca7