Cryptospike Security Vulnerabilities and Issues — Cryptospike CVE List

Lucene search

ProlionCryptospike

3 matches found

CVE•added 2023/12/12 1:15 a.m.•26 views

CVE-2023-36647

A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate arbitrary users and roles in web management and REST API endpoints via crafted JWT tokens.

7.5CVSS7.7AI score0.00073EPSS

CVE•added 2023/12/12 1:15 a.m.•22 views

CVE-2023-36650

A missing integrity check in the update system in ProLion CryptoSpike 3.0.15P2 allows attackers to execute OS commands as the root Linux user on the host system via forged update packages.

7.2CVSS7.2AI score0.00061EPSS

CVE•added 2023/12/12 1:15 a.m.•22 views

CVE-2023-36651

Hidden and hard-coded credentials in ProLion CryptoSpike 3.0.15P2 allow remote attackers to login to web management as super-admin and consume the most privileged REST API endpoints via these credentials.

7.2CVSS6.9AI score0.00279EPSS