Vulnerability

CVE-2023-31582

 Report advisory or correction

CVSS Score 7.5 high

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-331

References

https://github.com/KANIXB/JWTIssues/blob/main/jose4j%20issue.md
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-31582

[CVE-2023-31582] CWE-331: Insufficient Entropy

Description

jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less.

See org.bitbucket.b_c/jose4j package information