Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2024-31033

EPSS 0.15% · P35
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2024-31033

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey() method within the DefaultJwtParser class and the signWith() method within the DefaultJwtBuilder class. NOTE: the vendor disputes this because the "ignores" behavior cannot occur (in any version) unless there is a user error in how JJWT is used, and because the version that was actually tested must have been more than six years out of date.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Java JWT 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Java JWT是jwtk开源的一个用于 Java 和 Android 的 JSON Web 令牌。 Java JWT （JJWT）0.12.5版本存在安全漏洞，该漏洞源于 DefaultJwtParser 类中的 setSigningKey() 方法和 DefaultJwtBuilder 类中的 signWith() 方法中存在安全问题，会忽略某些字符，导致用户认为拥有强密钥。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
-n/a n/a -

II. Public POCs for CVE-2024-31033

#POC DescriptionSource LinkShenlong Link
1Details of CVE-2024-31033https://github.com/2308652512/JJWT_BUGPOC Details
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-31033

请登录查看更多情报信息。

Same Patch Batch · n/a · 2024-04-01 · 20 CVEs total

CVE-2024-31282.4 LOWReplify-Messenger Backup File androidmanifest.xml backup
CVE-2024-30861NetentSec NS-ASG 安全漏洞
CVE-2024-29435ALLDATA 安全漏洞
CVE-2024-29433ALLDATA 安全漏洞
CVE-2023-48906Btstack 安全漏洞
CVE-2024-30867NetentSec NS-ASG 安全漏洞
CVE-2024-30866NetentSec NS-ASG 安全漏洞
CVE-2024-30865NetentSec NS-ASG 安全漏洞
CVE-2024-30864NetentSec NS-ASG 安全漏洞
CVE-2024-30863NetentSec NS-ASG 安全漏洞
CVE-2024-30862NetentSec NS-ASG 安全漏洞
CVE-2024-30860NetentSec NS-ASG 安全漏洞
CVE-2024-30859NetentSec NS-ASG 安全漏洞
CVE-2024-30858NetentSec NS-ASG 安全漏洞
CVE-2024-30872NetentSec NS-ASG 安全漏洞
CVE-2024-30871NetentSec NS-ASG 安全漏洞
CVE-2024-30870NetentSec NS-ASG 安全漏洞
CVE-2024-30868NetentSec NS-ASG 安全漏洞
CVE-2024-25080Axigen 安全漏洞

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2024-31033

No comments yet

Leave a comment