CVE-2023-27001 Security feature bypass in n/a
Attackers can bypass signature verification to tamper with JWT payloads, leading to privilege escalation in Egerie Risk Manager.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-27001?
CVE-2023-27001 is a high-severity vulnerability in n/a, published on 8 Feb 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue discovered in Egerie Risk Manager v4.0.5 allows attackers to bypass the signature mechanism and tamper with the values inside the JWT payload resulting in privilege escalation.
Which versions are affected by CVE-2023-27001?
It affects 1 product.
Products include Egerie Egerie.
How do I fix CVE-2023-27001?
No fix has been published for CVE-2023-27001 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-27001 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-27001 exists.
Sources
Also known as GHSA-3cmg-74qc-2v44.