AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 does not correctly verify cryptographic signatures for JSON Web Tokens (JWT).
AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 does not correctly verify cryptographic signatures for JSON Web Tokens (JWT). A remote, unauthenticated attacker could forge a well-formed JWT without a valid signature and use it to execute privileged actions. Fixed in 9.2.41.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- AsiaInfo International
- Product
- Business Support System, aether-menu
- CVSS v3.1
- 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Exploitation
- SSVC none, automatable yes, impact total
- Fix
- available
- Weakness
- CWE-347
- NVD status
- Received
Why it ranks 45 (High)
- CVSS v3.1 9.8 critical
- SSVC: automatable
- SSVC: total technical impact
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.