Mageni Mageni Security LLC

Free and open-source vulnerability scanner

Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.

Install Now

Available for macOS, Windows, and Linux

App screenshot

CVE-2019-17195

CVE information

Published

4 years ago

Last Modified

5 months ago

CVSSv2.0 Severity

Medium

CVSSv3.1 Severity

Critical

Impact Analysis

Share

Description

Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass..

CVSSv2.0 Score

Severity
Medium
Base Score
6.8/10
Exploit Score
8.6/10
Access Vector
Network
Access Complexity
Medium
Authentication Required
None
Impact Score
6.4/10
Confidentiality Impact
Partial
Availability Impact
Partial
Integrity Impact
Partial

CVSSv3.1 Score

Severity
Critical
Base Score
9.8/10
Exploit Score
3.9/10
Access Vector
Network
Access Complexity
Low
Privileges Required
None
Impact Score
5.9/10
Confidentiality Impact
High
Availability Impact
High
Integrity Impact
High
Scope
Unchanged
User Interaction
None

Products Affected

CPE Affected Vulnerable Excluding Edit
cpe:2.3:a:connect2id:nimbus_jose\+jwt:*:*:*:*:*:*:*:*
  Yes
- 7.9
cpe:2.3:a:apache:hadoop:3.2.1:-:*:*:*:*:*:*
  Yes
- -
cpe:2.3:a:oracle:solaris_cluster:4.0:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:
  Yes
- -
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*
  Yes
- -
cpe:2.3:a:oracle:primavera_gateway:19.12.0:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:
  Yes
- -
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*
  Yes
18.8.0 -
cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0
  Yes
- -
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:
  Yes
- -
cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:*
  Yes
12.2.0 -
cpe:2.3:a:oracle:communications_cloud_native_core_security_e
  Yes
- -
cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*
  Yes
11.0 -
cpe:2.3:a:oracle:healthcare_data_repository:8.1.0:*:*:*:*:*:
  Yes
- -
cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*
  Yes
- -

References