CVE-2023-31579: Dromara Lamp-Cloud Use of Hard-coded Cryptographic Key

November 3, 2023

Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. This vulnerability allows attackers to authenticate to the application via a crafted JWT token.

References

github.com/advisories/GHSA-xr8c-mq5x-5f56
github.com/dromara/lamp-cloud/commit/31f79b122d85ed1b4f354673212692aa8205437a
github.com/dromara/lamp-cloud/issues/183
github.com/xubowenW/JWTissues/blob/main/lamp%20issue.md
nvd.nist.gov/vuln/detail/CVE-2023-31579

Code Behaviors & Features

Detect and mitigate CVE-2023-31579 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →