Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2024-31033

Quick assessment

Affected
n/a n/a
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Java JWT是jwtk开源的一个用于 Java 和 Android 的 JSON Web 令牌。 Java JWT （JJWT）0.12.5版本存在安全漏洞，该漏洞源于 DefaultJwtParser 类中的 setSigningKey() 方法和 DefaultJwtBuilder 类中的 signWith() 方法中存在安全问题，会忽略某些字符，导致用户认为拥有强密钥。

AI Predicted 3.7 Difficulty: Hard EPSS 0.78% · P53

Possible ATT&CK Techniques 1 AI

T1550 · Use Alternate Authentication Material
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-31033

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey() method within the DefaultJwtParser class and the signWith() method within the DefaultJwtBuilder class. NOTE: the vendor disputes this because the "ignores" behavior cannot occur (in any version) unless there is a user error in how JJWT is used, and because the version that was actually tested must have been more than six years out of date.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Java JWT 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Java JWT是jwtk开源的一个用于 Java 和 Android 的 JSON Web 令牌。 Java JWT （JJWT）0.12.5版本存在安全漏洞，该漏洞源于 DefaultJwtParser 类中的 setSigningKey() 方法和 DefaultJwtBuilder 类中的 signWith() 方法中存在安全问题，会忽略某些字符，导致用户认为拥有强密钥。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
- n/a n/a -

II. Public POCs for CVE-2024-31033

# POC Description Source Link Shenlong Link
1 Details of CVE-2024-31033 https://github.com/2308652512/JJWT_BUG POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-31033

请登录查看更多情报信息。

Other References for CVE-2024-31033 (4)

Same Patch Batch · n/a · 2024-04-01 · 20 CVEs total

CVE-2024-3128 2.4 LOW Replify-Messenger Backup File androidmanifest.xml backup
CVE-2024-30861 NetentSec NS-ASG 安全漏洞
CVE-2024-29435 ALLDATA 安全漏洞
CVE-2024-29433 ALLDATA 安全漏洞
CVE-2023-48906 Btstack 安全漏洞
CVE-2024-30867 NetentSec NS-ASG 安全漏洞
CVE-2024-30866 NetentSec NS-ASG 安全漏洞
CVE-2024-30865 NetentSec NS-ASG 安全漏洞
CVE-2024-30864 NetentSec NS-ASG 安全漏洞
CVE-2024-30863 NetentSec NS-ASG 安全漏洞
CVE-2024-30862 NetentSec NS-ASG 安全漏洞
CVE-2024-30860 NetentSec NS-ASG 安全漏洞
CVE-2024-30859 NetentSec NS-ASG 安全漏洞
CVE-2024-30858 NetentSec NS-ASG 安全漏洞
CVE-2024-30872 NetentSec NS-ASG 安全漏洞
CVE-2024-30871 NetentSec NS-ASG 安全漏洞
CVE-2024-30870 NetentSec NS-ASG 安全漏洞
CVE-2024-30868 NetentSec NS-ASG 安全漏洞
CVE-2024-25080 Axigen 安全漏洞

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2024-31033

No comments yet

Leave a comment