CVE-2023-36647

Name of the Vulnerable Software and Affected Versions ProLion CryptoSpike version 3.0.15P2

Description A hard-coded cryptographic private key used to sign JWT authentication tokens allows remote attackers to impersonate arbitrary users and roles in web management and REST API endpoints via crafted JWT tokens.

Recommendations For ProLion CryptoSpike version 3.0.15P2, consider regenerating and updating the cryptographic private key used for signing JWT authentication tokens to prevent impersonation attacks. As a temporary workaround, restrict access to the REST API endpoints and web management interfaces to minimize the risk of exploitation.