Description

Dromara Sureness before v1.0.8 was discovered to use a hardcoded key.

Remediation

References

https://github.com/dromara/sureness/issues/164

https://github.com/xubowenW/JWTissues/blob/main/sureness%20secure%20issues.md

Related Vulnerabilities

CVE-2021-23426 Vulnerability in npm package proto

CVE-2021-23411 Vulnerability in npm package anchorme

CVE-2018-3734 Vulnerability in npm package stattic

CVE-2021-46063 Vulnerability in maven package net.mingsoft:ms-mcms

CVE-2021-21388 Vulnerability in npm package systeminformation

Severity

Critical

Classification

CWE-798 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Issue Tracking Third Party Advisory