CVE-2023-40171
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-40171
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-40171.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-40171
- Aliases
-
- GHSA-fv3x-67q3-6pg7
- Published
- 2023-08-17T21:19:28.326Z
- Modified
- 2025-12-05T00:03:26.350002Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- Dispatch writes JWT tokens in error message
- Details
-
Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when the
Dispatch Plugin - Basic Authentication Providerplugin encounters an error when attempting to decode a JWT token. Any Dispatch users who own their instance and rely on theDispatch Plugin - Basic Authentication Providerplugin for authentication may be impacted, allowing for any account to be taken over within their own instance. This could be done by using the secret to sign attacker crafted JWTs. If you think that you may be impacted, we strongly suggest you to rotate the secret stored in theDISPATCH_JWT_SECRETenvvar in the.envfile. This issue has been addressed in commitb1942a4319which has been included in the20230817release. users are advised to upgrade. There are no known workarounds for this vulnerability. - Database specific
{ "cwe_ids": [ "CWE-209" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40171.json", "cna_assigner": "GitHub_M" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40171.json
- https://github.com/Netflix/dispatch/commit/b1942a4319f0de820d86b84a58ebc85398b97c70
- https://github.com/Netflix/dispatch/pull/3695
- https://github.com/Netflix/dispatch/releases/tag/latest
- https://github.com/Netflix/dispatch/security/advisories/GHSA-fv3x-67q3-6pg7
- https://nvd.nist.gov/vuln/detail/CVE-2023-40171
Affected packages
Git / github.com/netflix/dispatch
Affected ranges
- Type
- GIT
- Repo
- https://github.com/netflix/dispatch
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed