CVE-2023-36647

Summary

A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate arbitrary users and roles in web management and REST API endpoints via crafted JWT tokens.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• https://www.cvcn.gov.it/cvcn/cve/CVE-2023-36647

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: partial

References

• https://www.cvcn.gov.it/cvcn/cve/CVE-2023-36647

• ←Previous
• Next→