Vulnerabilities > CVE-2023-31582 - Insufficient Entropy vulnerability in Jose4J Project Jose4J

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

jose4j-project

CWE-331

NVD

Published: 2023-10-25

Updated: 2023-10-31

Summary

jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less.

Vulnerable Configurations

Part	Description	Count
Application	Jose4J_Project Jose4J Project Jose4J - Jose4J Project Jose4J 0.1.0 Jose4J Project Jose4J 0.1.1 Jose4J Project Jose4J 0.2.0 Jose4J Project Jose4J 0.2.1 Jose4J Project Jose4J 0.2.2 Jose4J Project Jose4J 0.2.3 Jose4J Project Jose4J 0.2.4 Jose4J Project Jose4J 0.2.5 Jose4J Project Jose4J 0.2.6 Jose4J Project Jose4J 0.2.7 Jose4J Project Jose4J 0.3.0 Jose4J Project Jose4J 0.3.1 Jose4J Project Jose4J 0.3.2 Jose4J Project Jose4J 0.3.3 Jose4J Project Jose4J 0.3.4 Jose4J Project Jose4J 0.3.5 Jose4J Project Jose4J 0.3.6 Jose4J Project Jose4J 0.3.7 Jose4J Project Jose4J 0.3.8 Jose4J Project Jose4J 0.3.9 Jose4J Project Jose4J 0.4.0 Jose4J Project Jose4J 0.4.1 Jose4J Project Jose4J 0.4.2 Jose4J Project Jose4J 0.4.3 Jose4J Project Jose4J 0.4.4 Jose4J Project Jose4J 0.5.0 Jose4J Project Jose4J 0.5.1 Jose4J Project Jose4J 0.5.2 Jose4J Project Jose4J 0.5.3 Jose4J Project Jose4J 0.5.4 Jose4J Project Jose4J 0.5.5 Jose4J Project Jose4J 0.5.6 Jose4J Project Jose4J 0.5.7 Jose4J Project Jose4J 0.5.8 Jose4J Project Jose4J 0.6.0 Jose4J Project Jose4J 0.6.1 Jose4J Project Jose4J 0.6.2 Jose4J Project Jose4J 0.6.3 Jose4J Project Jose4J 0.6.4 Jose4J Project Jose4J 0.6.5 Jose4J Project Jose4J 0.7.0 Jose4J Project Jose4J 0.7.1 Jose4J Project Jose4J 0.7.2 Jose4J Project Jose4J 0.7.3 Jose4J Project Jose4J 0.7.4 Jose4J Project Jose4J 0.7.5 Jose4J Project Jose4J 0.7.6 Jose4J Project Jose4J 0.7.7 Jose4J Project Jose4J 0.7.8 Jose4J Project Jose4J 0.7.9 Jose4J Project Jose4J 0.7.10 Jose4J Project Jose4J 0.7.11 Jose4J Project Jose4J 0.7.12 Jose4J Project Jose4J 0.8.0 Jose4J Project Jose4J 0.9.0 Jose4J Project Jose4J 0.9.1 Jose4J Project Jose4J 0.9.2	58

Common Weakness Enumeration (CWE)

CWE-331 - Insufficient Entropy

Common Attack Pattern Enumeration and Classification (CAPEC)

Session Credential Falsification through Prediction
This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

References