Weak Cryptography

2022-02-2108:32:03

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

weak cryptography

setjwtsecret function

hard-coded secret key

authentication token

admin privileges

EPSS

0.002

Percentile

61.8%

JSON

github.com/gravitl/netmaker is vulnerable to weak cryptography. The vulnerability exits in SetJWTSecret function of wts.go due to hard-coded secret key which allows an attacker to create a valid authentication token for any user and use it with admin privileges.