node-jsonwebtoken is a JsonWebToken implementation for node.js. For versions `<= 8.5.1` of `jsonwebtoken` library, if a malicious actor has the ability to modify the key retrieval parameter (referring to the `secretOrPublicKey` argument from the readme link of the `jwt.verify()` function, they can write arbitrary files on the host machine. Users are affected only if untrusted entities are allowed to modify the key retrieval parameter of the `jwt.verify()` on a host that you control. This issue has been fixed, please update to version 9.0.0.
| CVE Infomation | Exploits or more Infomation |
|---|---|
| mitre | EXPLOIT DATABASE |
| NVD | 0day.today |
| vulmon.com | github |
| CVE Details | |
| JVN ENG JPN | |
| Reconshell |
Software Tag: iOS(1 tweets)
List of frequently cited URLs
List of frequently cited URLs
| URL | Num of Times Referred to |
|---|---|
| thehackernews.com | 203 |
| cvetrends.com | 51 |
| github.com | 7 |
| unit42.paloaltonetworks.jp | 7 |
| unit42.paloaltonetworks.com | 7 |
| canyoupwn.me | 4 |
| opsmtrs.com | 3 |
| twitter.com | 3 |
| b.hatena.ne.jp | 3 |
| security.sios.jp | 3 |
| securityboulevard.com | 3 |
| xcloud.spectrum.colortokens.com | 3 |
| Name | URL |
|---|---|
| despossivel/CVE-2022-23529-lab | https://github.com/despossivel/CVE-2022-23529-lab |
| Live-Hack-CVE/CVE-2022-23529 | https://github.com/Live-Hack-CVE/CVE-2022-23529 |
| Name | URL |
|---|---|
| despossivel/CVE-2022-23529-lab | github.com |
| Live-Hack-CVE/CVE-2022-23529 | github.com |