Read the docs
TI-2024-38699 Aliases GHSA-r2r8-36pq-27cm

nzo/url-encryptor-bundle Insecure default secret key and IV allowing anyone to decrypt values

Priority LOW 38Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

Versions of nzo/url-encryptor-bundle prior to 5.0.1 and 4.3.2 are affected by a security vulnerability related to the lack of mandatory key and IV requirements. By default, the bundle uses the aes-256-ctr algorithm, which is susceptible to malleability attacks, potentially leading to Insecure Direct Object Reference (IDOR) vulnerabilities. Additionally, the reuse of keys enables users to decrypt and modify encrypted data if they can guess the plaintext of one ciphertext.

Why it matters now

Fix Fixed nzo/url-encryptor-bundle (Packagist): 5.0.1, 4.3.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—nzo/url-encryptor-bundle (Packagist)5.0.0 to before 5.0.15.0.1Patch availableGHSA-r2r8-36pq-27cm
—nzo/url-encryptor-bundle (Packagist)4.0.0 to before 4.3.24.3.2Patch availableGHSA-r2r8-36pq-27cm
  • nzo/url-encryptor-bundle (Packagist) Vendor— Affected 5.0.0 to before 5.0.1 Fixed in 5.0.1 Patch available GHSA-r2r8-36pq-27cm
  • nzo/url-encryptor-bundle (Packagist) Vendor— Affected 4.0.0 to before 4.3.2 Fixed in 4.3.2 Patch available GHSA-r2r8-36pq-27cm

Remediation

  • Fix · GHSA-r2r8-36pq-27cm nzo/url-encryptor-bundle (Packagist) Fixed in 5.0.1 Advisory →
  • Fix · GHSA-r2r8-36pq-27cm nzo/url-encryptor-bundle (Packagist) Fixed in 4.3.2 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-r2r8-36pq-27cm

References

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences