CVE-2022-23541

Katalog CVE

CVSS 6.3 · Medium EPSS 0,77%

Kerentanan Improper Authentication pada auth0 jsonwebtoken. Skor CVSS 3.1 6.3 (Medium) menurut NVD.

Deskripsi (NVD)

jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function referring to the `secretOrPublicKey` argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.

Rincian

Terbit di NVD

22 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-1259: Improper Restriction of Security Token Assignment

EPSS (30 hari)

0,77% peluang dieksploitasi; lebih tinggi dari 54,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3 patch
• https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959 advisory pihak ketiga
• https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0 release notes
• https://security.netapp.com/advisory/ntap-20240621-0007/