GHSA-54f6-9mx9-86f7

Source

https://github.com/advisories/GHSA-54f6-9mx9-86f7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-54f6-9mx9-86f7/GHSA-54f6-9mx9-86f7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-54f6-9mx9-86f7

Aliases

CVE-2023-44794

Published

2023-10-25T18:32:23Z

Modified

2024-09-12T18:46:08.445247Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

SaToken privilege escalation vulnerability

Details

An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL.

Database specific

{
    "nvd_published_at": "2023-10-25T18:17:32Z",
    "cwe_ids": [
        "CWE-281",
        "CWE-284"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-27T19:50:04Z"
}

References

Affected packages

Maven / cn.dev33:sa-token-core

Package

Name: cn.dev33:sa-token-core; View open source insights on deps.dev
Purl: pkg:maven/cn.dev33/sa-token-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.37.0

Affected versions

1.*

1.6.0

1.7.0

1.8.0

1.9.0

1.10.0

1.11.0

1.12.0

1.12.1

1.13.0

1.14.0

1.15.0

1.15.0.RELEASE

1.15.2

1.16.0

1.16.0.RELEASE

1.17.0

1.18.0

1.19.0

1.20.0

1.21.0

1.22.0

1.23.0

1.24.0

1.25.0

1.26.0

1.27.0

1.28.0

1.29.0

1.29.1.trial

1.30.0.RC

1.30.0

1.31.0.RC

1.31.0

1.31.1.temp

1.31.1.trial

1.31.2.temp

1.31.3.temp

1.32.0

1.33.0

1.34.0

1.34.0.temp1

1.35.0.RC

1.36.0