Vseen

**Name of the Vulnerable Software and Affected Versions** zhistaredu StarTraining versions prior to 3.8.2 **Description** A remote issue exists in the JWT Token Handler component within the `UserLoginService.createToken()` function of the `application.yml` file. Manipulating the `user id` or `company id` arguments leads to the use of a hard-coded password. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** zhistaredu StarTraining versions prior to 3.8.2 **Description** A remote issue exists in the Druid Console component within the `/druid/index.html` file. The `anonymous()` function is susceptible to manipulation, which allows an attacker to bypass authentication requirements. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `/druid/index.html` file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** zhistaredu StarTraining versions prior to 3.8.2 **Description** A security flaw exists in the `api-docs` endpoint within the `SecurityConfig.java` file. A manipulation of an unknown function in this component allows a remote attacker to bypass authentication, resulting in missing authentication. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the `api-docs` endpoint to minimize the risk of exploitation.