Lucene search

Veracode Vulnerability DatabaseVERACODE:48241

HistoryJul 26, 2024 - 2:40 p.m.

Improper Restriction Of Security Token Assignment

2024-07-2614:40:37

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

vulnerability

jwt key

configuration file

bypass

backend access

CVSS3

6.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

6.8

Confidence

High

JSON

github.com/KubeOperator/kubepi is vulnerable to Improper Restriction of Security Token Assignment. The vulnerability is due to an empty JWT key in the default configuration file, which allows for a bypass of the login verification and direct backend access.

References

github.com/1Panel-dev/KubePi/security/advisories/GHSA-8q5r-cvcw-4wx7