CVE-2023-36647

creationtimestamp| type| source ---|---|--- 2024-01-01 15:06:58+00:00| seen| https://t.me/ctinow/161326...

CVE-2023-36647

A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate arbitrary users and roles in web management and REST API endpoints via crafted JWT tokens...

CVE-2023-36647

A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate arbitrary users and roles in web management and REST API endpoints via crafted JWT tokens...

CVE-2023-36647

Summary: CVE-2023-36647 affects ProLion CryptoSpike 3.0.15P2, where a hard-coded cryptographic private key is used to sign JWTs, enabling remote impersonation of users/roles in web management and REST API endpoints. The vulnerability arises from the use of a private key embedded in the product, e...

CVE-2023-36647

A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate arbitrary users and roles in web management and REST API endpoints via crafted JWT tokens...

CVE-2023-36647

A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate arbitrary users and roles in web management and REST API endpoints via crafted JWT tokens...