by Kastro
Paper/Archive/CVE-2023-53951

CVE-2023-53951

Gauzy ever gauzy — Ever Gauzy v0.281.9 JWT Authentication Weakness via HMAC Secret

EPSS 0.4%public exploitCVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 29.7.297 × 205.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Ever Gauzy v0.281.9 contains a JWT authentication vulnerability that allows attackers to exploit weak HMAC secret key implementation. Attackers can leverage the exposed JWT token to authenticate and gain unauthorized access with administrative permissions.

Affected

ProductAffectedFixed inSource
ever gauzy0.281.9–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitexploit-db.com/exploits/51354refgithub.com/ever-co/ever-gauzywriteupvulncheck.com/advisories/ever-gauzy-jwt-authentication-weakness-via-hmac-secret