CVE-2022-31157

LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the function used to generate random nonces was not sufficiently cryptographically complex. Users should upgrade to version 5.0 to receive a patch. There are currently no known workarounds.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/packbackbooks/lti-1-3-php-library/security/advisories/GHSA-768m-5w34-2xf5	Third Party Advisory
https://github.com/packbackbooks/lti-1-3-php-library/security/advisories/GHSA-768m-5w34-2xf5	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:packback:lti_1.3_tool_library:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:04

Type	Values Removed	Values Added
References	~~() https://github.com/packbackbooks/lti-1-3-php-library/security/advisories/GHSA-768m-5w34-2xf5 - Third Party Advisory~~	() https://github.com/packbackbooks/lti-1-3-php-library/security/advisories/GHSA-768m-5w34-2xf5 - Third Party Advisory

24 Jul 2023, 13:08

Type	Values Removed	Values Added
CWE	~~CWE-327~~	CWE-330

Information

Published : 2022-07-15 18:15

Updated : 2024-11-21 07:04

NVD link : CVE-2022-31157

Mitre link : CVE-2022-31157

CVE.ORG link : CVE-2022-31157

JSON object : View

Products Affected

packback

lti_1.3_tool_library

CWE

CWE-327

Use of a Broken or Risky Cryptographic Algorithm

CWE-330

Use of Insufficiently Random Values

{"id": "CVE-2022-31157", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-07-15T18:15:08.910", "references": [{"url": "https://github.com/packbackbooks/lti-1-3-php-library/security/advisories/GHSA-768m-5w34-2xf5", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/packbackbooks/lti-1-3-php-library/security/advisories/GHSA-768m-5w34-2xf5", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-327"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-330"}]}], "descriptions": [{"lang": "en", "value": "LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the function used to generate random nonces was not sufficiently cryptographically complex. Users should upgrade to version 5.0 to receive a patch. There are currently no known workarounds."}, {"lang": "es", "value": "LTI versi\u00f3n 1.3 Tool Library es una biblioteca usada para construir proveedores de herramientas LTI versi\u00f3n 1.3 certificados por IMS en PHP. En versiones anteriores a 5.0, la funci\u00f3n usada para generar nonces aleatorios no era suficientemente compleja desde el punto de vista criptogr\u00e1fico. Los usuarios deben actualizar a versi\u00f3n 5.0 para recibir un parche. Actualmente no se presentan mitigaciones conocidas"}], "lastModified": "2024-11-21T07:04:01.233", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:packback:lti_1.3_tool_library:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE9B22D1-338D-4B61-BEEA-62E445BE2D39", "versionEndExcluding": "5.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}