CVE-2022-29266

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-29266
In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependency lua-resty-jwt contains sensitive information.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://www.openwall.com/lists/oss-security/2022/04/20/1 Mailing List Third Party Advisory
https://lists.apache.org/thread/6qpfyxogbvn18g9xr8g218jjfjbfsbhr Mailing List Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:*
History

29 Apr 2022, 23:38

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : 5.0
v3 : 7.5
CWE CWE-209
CPE cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:*
References (MLIST) http://www.openwall.com/lists/oss-security/2022/04/20/1 - (MLIST) http://www.openwall.com/lists/oss-security/2022/04/20/1 - Mailing List, Third Party Advisory
References (MISC) https://lists.apache.org/thread/6qpfyxogbvn18g9xr8g218jjfjbfsbhr - (MISC) https://lists.apache.org/thread/6qpfyxogbvn18g9xr8g218jjfjbfsbhr - Mailing List, Vendor Advisory

25 Apr 2022, 12:16

Type Values Removed Values Added
Summary In APache APISIX before 3.13.1, an attacker can obtain a plugin-configured secret via an error message response by sending an incorrect JSON Web Token to a route protected by the jwt-auth plugin. The error logic in the dependency library lua-resty-jwt enables sending an RS256 token to an endpoint that requires an HS256 token, with the original secret value included in the error response. In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependency lua-resty-jwt contains sensitive information.

20 Apr 2022, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-04-20 08:15

Updated : 2024-02-04 22:29

NVD link : CVE-2022-29266

Mitre link : CVE-2022-29266

CVE.ORG link : CVE-2022-29266

JSON object : View

Products Affected

apache

  • apisix
CWE
CWE-209

Generation of Error Message Containing Sensitive Information