adaptivescale/lxdui · Security
AdaptiveScale LXDUI Hardcoded JWT Secret Key
- GHSA ID
- GHSA-p4xh-4869-8vrg
- CVE ID
- CVE-2021-40494
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v4
- 9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
A Hardcoded JWT Secret Key in __metadata__.py metadata.py in AdaptiveScale LXDUI through 2.1.3 allows attackers to gain admin access to the host system.
CWEs
- CWE-798 · Use of Hard-coded Credentials
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-40494 ↗
- https://github.com/AdaptiveScale/lxdui/pull/353 ↗
- https://github.com/AdaptiveScale/lxdui/commit/e4bffeb9d69a5700a642cb6424453d1894e50d84 ↗
- https://github.com/pypa/advisory-database/tree/main/vulns/lxdui/PYSEC-2021-342.yaml ↗
- https://github.com/advisories/GHSA-p4xh-4869-8vrg ↗