GHSA-mj5w-w588-j6xg

Source

https://github.com/advisories/GHSA-mj5w-w588-j6xg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-mj5w-w588-j6xg/GHSA-mj5w-w588-j6xg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mj5w-w588-j6xg

Aliases

CVE-2022-35540

Published

2022-08-19T00:00:16Z

Modified

2023-11-08T04:09:51.086306Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Use of Hard-coded Credentials in AgileConfig.Client

Details

Hardcoded JWT Secret in AgileConfig <1.6.8 Server allows remote attackers to use the generated JWT token to gain administrator access.

Database specific

{
    "nvd_published_at": "2022-08-18T23:15:00Z",
    "github_reviewed_at": "2022-08-30T20:19:47Z",
    "severity": "CRITICAL",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-798"
    ]
}

References

Affected packages

NuGet / AgileConfig.Client

Package

Name: AgileConfig.Client; View open source insights on deps.dev
Purl: pkg:nuget/AgileConfig.Client

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.8

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.0.10

1.0.11

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.1.8

1.1.8.1

1.1.8.2

1.1.8.3

1.1.8.4

1.1.8.5

1.1.8.6

1.1.8.7

1.1.8.8

1.1.8.9

1.1.8.10

1.1.8.11

1.1.9

1.2.0

1.2.1

1.2.1.1

1.2.1.2

1.2.1.3

1.2.1.4

1.2.1.5

1.2.1.6

1.2.1.7

1.2.1.8

1.2.1.9

1.2.1.10

1.6.0-preview

1.6.0

1.6.1

1.6.2

1.6.2.1

1.6.2.2