High severityNVD Advisory· Published Nov 2, 2023· Updated Sep 17, 2024

CVE-2023-31579

Description

Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. This vulnerability allows attackers to authenticate to the application via a crafted JWT token.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
top.tangyh.basic:lamp-coreMaven	< 3.8.1	3.8.1
top.tangyh.basic:lamp-utilMaven	< 3.8.1	3.8.1

Affected products

Dromara/Lamp Cloudcpe-rescue
ghsa-coords2 versions
pkg:maven/top.tangyh.basic/lamp-core pkg:maven/top.tangyh.basic/lamp-util
< 3.8.1+ 1 more
- (no CPE)range: < 3.8.1
- (no CPE)range: < 3.8.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-xr8c-mq5x-5f56ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-31579ghsaADVISORY
github.com/dromara/lamp-cloud/commit/31f79b122d85ed1b4f354673212692aa8205437aghsaWEB
github.com/dromara/lamp-cloud/issues/183ghsaWEB
github.com/xubowenW/JWTissues/blob/main/lamp%20issue.mdghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000