Vulnerabilities > CVE-2022-39227 - Unspecified vulnerability in Python-Jwt Project Python-Jwt

CVSS 9.1 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

python-jwt-project

critical

NVD

Published: 2022-09-23

Updated: 2024-11-21

Summary

python-jwt is a module for generating and verifying JSON Web Tokens. Versions prior to 3.3.4 are subject to Authentication Bypass by Spoofing, resulting in identity spoofing, session hijacking or authentication bypass. An attacker who obtains a JWT can arbitrarily forge its contents without knowing the secret key. Depending on the application, this may for example enable the attacker to spoof other user's identities, hijack their sessions, or bypass authentication. Users should upgrade to version 3.3.4. There are no known workarounds.

Vulnerable Configurations

Part	Description	Count
Application	Python-Jwt_Project Python JWT Project Python JWT 3.0.0 Python JWT Project Python JWT 3.1.0 Python JWT Project Python JWT 3.2.0 Python JWT Project Python JWT 3.2.1 Python JWT Project Python JWT 3.2.2 Python JWT Project Python JWT 3.2.3 Python JWT Project Python JWT 3.2.4 Python JWT Project Python JWT 3.2.5 Python JWT Project Python JWT 3.2.6 Python JWT Project Python JWT 3.3.0 Python JWT Project Python JWT 3.3.1 Python JWT Project Python JWT 3.3.2 Python JWT Project Python JWT 3.3.3	13

Summary

Vulnerable Configurations

References