CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS
Percentile
31.8%
The function used to generate random nonces was not sufficiently cryptographically complex. As a result values may be predictable and tokens may be forgable.
Users should upgrade to version 5.0 immediately
None.
github.com/advisories/GHSA-768m-5w34-2xf5
github.com/packbackbooks/lti-1-3-php-library/commit/de19e8a0b28cdc7750fa3ca98471eeed26ba3e57
github.com/packbackbooks/lti-1-3-php-library/security/advisories/GHSA-768m-5w34-2xf5
nvd.nist.gov/vuln/detail/CVE-2022-31157
openid.net/specs/openid-connect-core-1_0.html#IDToken