En resumen
- CVE-2021-46743 es una vulnerabilidad CRÍTICO (CVSS 9.1) que afecta a firebase/php-jwt, firebase php-jwt (google).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.92%, mayor que el 60.4% de las vulnerabilidades.
- Solución: actualizar a 6.0.0 o posterior.
Description
In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g., RS256 / HS256) exists via the kid (aka Key ID) header, when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. NOTE: this provides a straightforward way to use the PHP-JWT library unsafely, but might not be considered a vulnerability in the library itself.
NVD description
In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g., RS256 / HS256) exists via the kid (aka Key ID) header, when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. NOTE: this provides a straightforward way to use the PHP-JWT library unsafely, but might not be considered a vulnerability in the library itself.
Más vulnerabilidades de firebase/php-jwt
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free