CVE-2024-53356

CRITICAL

9.8

Description

Weak JWT Secret vulnerabilitiy in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote attackers to generate JWT for privilege escalation. The HMAC secret used for generating tokens is hardcoded as "somerandomaccesstoken". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens (JWTs), allowing them access to important information and actions within the application.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie1/31/2025

Derniere modification5/23/2025

Sourcenvd

Observations honeypot0

Produits affectes

easyvirt:co2scopeeasyvirt:dcscope

Faiblesses (CWE)

CWE-798

References

https://github.com/Elymaro/CVE/blob/main/EasyVirt/CVE-2024-53356.md(cve@mitre.org)

https://github.com/Elymaro/CVE/blob/main/EasyVirt/CVE-2024-53356.md(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.