PT-2023-21226

CVE-2023-27583

Publicado

2023-03-13

Atualizado

2023-03-17

Descrição por

CVSS 3.1

9.8

Crítica

MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PanIndex versions prior to 3.1.3

Description The issue concerns a hard-coded JWT key PanIndex used in PanIndex. This allows an attacker to sign a JWT token and perform actions with admin privileges.

Recommendations For versions prior to 3.1.3, update to version 3.1.3 to resolve the issue. As a temporary workaround for versions prior to 3.1.3, consider changing the JWT key in the source code before compiling the project.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Cokebeer

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-321: Use of Hard-coded Cryptographic Key

CWE-798: Use of Hard-coded Credentials

Identificadores relacionados