CVE-2022-31158 Authentication Bypass by Capture-replay in packbackbooks/lti-1-3-php-library
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2022-31158?
CVE-2022-31158 is a high-severity vulnerability in packbackbooks lti-1-3-php-library, published on 15 Jul 2022.
Official description
LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the Nonce Claim Value was not being validated against the nonce value sent in the Authentication Request. Users should upgrade to version 5.0 to receive a patch. There are currently no known workarounds.
Weakness: CWE-294
Which versions are affected by CVE-2022-31158?
2 open source packages ship an affected version, including packbackbooks/lti-1-3-php-library. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
packbackbooks/lti-1-3-php-library Packagist | All versions | 5.0 |
packbackbooks/lti-1-3-php-library Packagist | All versions | 5.0 |
Products include Packback Lti 1.3 Tool Library.
How do I fix CVE-2022-31158?
Upgrade packbackbooks/lti-1-3-php-library to 5.0 or later.
Is CVE-2022-31158 being exploited?
There is no known exploitation of CVE-2022-31158 in the wild and no public exploit code.
Other vulnerabilities in packbackbooks lti-1-3-php-library
Sources
Also known as GHSA-5p73-qg2v-383h.