youth-is-as-pale-as-poetry e-learning JWT Token JwtUtils.java encryptSecret random values

A vulnerability has been found in youth-is-as-pale-as-poetry e-learning 1.0. Impacted is the function encryptSecret of the file e-learning-master\exam-api\src\main\java\com\yf\exam\ability\shiro\jwt\JwtUtils.java of the component JWT Token Handler. The manipulation leads to insufficiently random values. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

使用不充分的随机数

e-learning 安全特征问题漏洞

e-learning是youth-is-as-pale-as-poetry个人开发者的一个考试系统。 e-learning 1.0版本存在安全特征问题漏洞，该漏洞源于JWT Token Handler组件中JwtUtils.java文件的encryptSecret函数生成随机值不足，可能导致远程攻击。

N/A

N/A