Upstream information

CVE-2023-32188 at MITRE

Description

A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.

Upstream Security Advisories:

https://github.com/neuvector/neuvector/security/advisories/GHSA-622h-h2p8-743x

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having critical severity.

CVSS v4 Scores
	CNA (SUSE)
Base Score	9.4
Vector	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector	Network
Attack Complexity	Low
Attack Requirements	None
Privileges Required	Low
User Interaction	None
Vulnerable System Confidentiality Impact	High
Vulnerable System Integrity Impact	High
Vulnerable System Availability Impact	High
Subsequent System Confidentiality Impact	High
Subsequent System Integrity Impact	High
Subsequent System Availability Impact	High
CVSSv4 Version	4.0

SUSE Bugzilla entry: 1215174 [NEW]

SUSE Security Advisories:

GHSA-622h-h2p8-743x, published Fri Oct 6 16:48:00 CEST 2023

SUSE Timeline for this CVE

CVE page created: Fri Sep 8 18:30:43 2023
CVE page last modified: Wed Oct 16 15:47:33 2024