CVE-2023-22644

published 2023-09-20

CVE-2023-22644: A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform…

critical 9.4 CVSS 4.0

AV N AC L AT N PR L UI N VC H VI H VA H SC H SI H SA H E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
github.com	neuvector_neuvector	>= 0 < 0.0.0-20231003121714-be746957ee7c	0.0.0-20231003121714-be746957ee7c
suse	manager_server	>= 4.2 < 4.2.50-150300.3.66.5	4.2.50-150300.3.66.5
suse	manager_server	>= 4.3 < 4.3.58-150400.3.46.4	4.3.58-150400.3.46.4
suse	neuvector	< 0.0.0-20231003121714-be746957ee7c	0.0.0-20231003121714-be746957ee7c

CWE-1270 CWE-287 CWE-532