CVE-2023-36649

Name of the Vulnerable Software and Affected Versions ProLion CryptoSpike version 3.0.15P2

Description The issue allows remote attackers to impersonate other users in web management and the REST API by reading JWT tokens from logs as a Grafana authenticated user or from the Loki REST API without authentication. This is due to the insertion of sensitive information in the centralized logging system.

Recommendations For ProLion CryptoSpike version 3.0.15P2, consider restricting access to the Grafana logging system and the Loki REST API to minimize the risk of exploitation. As a temporary workaround, avoid using the REST API until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.