PT-2024-3099 · Atlassian +1 · Confluence Data Center/Server +4

🗓️ 10 Feb 2024 00:00:00Reported by Positive TechnologiesType

ptsecurity

ptsecurity🔗 dbugs.ptsecurity.com👁 1 Views

PBKDF2 DoS in Nimbus JOSE+JWT via large JWE p2c header; unauthenticated, high availability impact.

Reporter	Title	Published	Views	Family All 95
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 1.14.4 IF001	14 May 202420:42	–	ibm
IBM Security Bulletins	Security Bulletin: The IBM® Engineering Lifecycle Management is impacted by vulnerabilties in Nimbus-JOSE-JWT	10 Mar 202507:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Asset Data Dictionary uses multiple third party dependencies which is vulnerable to CVEs.	6 Feb 202505:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application suite Visual Inspection Component back ported version 8.9.x uses components that are vulnerable to CVE-2021-31684, CVE-2023-1370, CVEID: CVE-2023-52428, CVE-2024-7254,CVE-2024-27268.	9 Mar 202607:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Lifecycle Optimization - Publishing - In Connect2id Nimbus JOSE+JWT, an attacker can cause a denial of service	4 Aug 202506:37	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerability fixes in IBM webMethods Managed File Transfer On-Prem	22 Dec 202513:43	–	ibm
IBM Security Bulletins	Security Bulletin: EDB PGAI Hybrid Management with IBM is affected by Multiple Vulnerabilities.	6 May 202615:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct for UNIX is vulnerable to denial of service due to nimbus-jose-jwt.	29 Mar 202420:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilities	6 Mar 202616:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.10	29 Jul 202522:30	–	ibm

Source	Link
osv	www.osv.dev/vulnerability/CVE-2023-52428
osv	www.osv.dev/vulnerability/GHSA-gvpg-vgmx-xg6w
bdu	www.bdu.fstec.ru/vul/2024-03299
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-52428
bitbucket	www.bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
github	www.github.com/jeremylong/DependencyCheck/issues/6464
twitter	www.twitter.com/Esparta6108713/status/1756572698522612083
twitter	www.twitter.com/VulmonFeeds/status/1756568327625846814
t	www.t.me/cvenotify/100072

16 Apr 2025 00:00Current

6Medium risk

Vulners AI Score6

CVSS 48.7

CVSS 3.17.5

EPSS0.00108

SSVC

password based decrypter nimbus library large jwe header unauthenticated high availability impact confluence data center bamboo data center