CVE-2022-35540 - Hardcoded JWT Secret in AgileConfig <1.6.8 Server allows remote attackers to use the generated JWT token to gain administrator access

CRITICAL

Hardcoded JWT Secret in AgileConfig <1.6.8 Server allows remote attackers to use the generated JWT token to gain administrator access

Published Aug 18, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 1.39%

Hardcoded JWT Secret in AgileConfig <1.6.8 Server allows remote attackers to use the generated JWT token to gain administrator access.

No remediation recorded yet.

Weaknesses (1)

CWE-798

Hard-coded Credentials

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6585		Advisory
https://github.com/advisories/GHSA-mj5w-w588-j6xg		Advisory
https://github.com/dotnetcore/AgileConfig/issues/91		x_refsource_MISCIssue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-35540