Json-jwt Project

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

Json-jwt Project records in CISA KEV

No Json-jwt Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Json-jwt 3 records HIGH

Records

3 records in Json-jwt · all components

TI-2023-28402 CVE-2023-51774 · GHSA-c8v6-786g-vjx6

The json-jwt (aka JSON::JWT) gem 1.16.3 for Ruby sometimes allows bypass of identity…

HIGH 72

The json-jwt (aka JSON::JWT) gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack.

CVSS 3.1HIGH 8.4 Local No auth No interaction EPSS 0.00231 Published 2023-12-25 Fixed in 1.16.6, 1.15.3.1 CWE-284

TI-2019-13583 CVE-2019-18848 · GHSA-cff7-6h4q-q5pj

The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.

LOW 35

The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01257 Published 2019-11-12 Fixed in 1.11.0 CWE-287

TI-2018-15937 CVE-2018-1000539 · GHSA-mj4x-wcxf-hm8x

Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of…

LOW 25

Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authe…

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.00765 Published 2018-06-26 Fixed in 1.9.4 CWE-347

Open these records in search →

Critical	0
High	2
Medium	1
Low	0
No CVSS	0