CVE-2022-31158

LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the Nonce Claim Value was not being validated against the nonce value sent in the Authentication Request. Users should upgrade to version 5.0 to receive a patch. There are currently no known workarounds.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/packbackbooks/lti-1-3-php-library/security/advisories/GHSA-5p73-qg2v-383h	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:packback:lti_1.3_tool_library:*:*:*:*:*:*:*:*

History

24 Jul 2023, 13:08

Type	Values Removed	Values Added
CWE	~~CWE-327~~	CWE-294

Information

Published : 2022-07-15 18:15

Updated : 2024-02-28 19:29

NVD link : CVE-2022-31158

Mitre link : CVE-2022-31158

CVE.ORG link : CVE-2022-31158

JSON object : View

Products Affected

packback

lti_1.3_tool_library

CWE

CWE-294

Authentication Bypass by Capture-replay

{"id": "CVE-2022-31158", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-07-15T18:15:08.973", "references": [{"url": "https://github.com/packbackbooks/lti-1-3-php-library/security/advisories/GHSA-5p73-qg2v-383h", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-294"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-294"}]}], "descriptions": [{"lang": "en", "value": "LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the Nonce Claim Value was not being validated against the nonce value sent in the Authentication Request. Users should upgrade to version 5.0 to receive a patch. There are currently no known workarounds."}, {"lang": "es", "value": "LTI versi\u00f3n 1.3 Tool Library es una biblioteca usada para construir proveedores de herramientas LTI versi\u00f3n 1.3 certificados por IMS en PHP. En versiones anteriores a 5.0, el valor Nonce Claim no se estaba comprendiendo contra el valor nonce enviado en la petici\u00f3n de autenticaci\u00f3n. Los usuarios deben actualizar a versi\u00f3n 5.0 para recibir un parche. Actualmente no se presentan mitigaciones conocidas"}], "lastModified": "2023-07-24T13:08:42.310", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:packback:lti_1.3_tool_library:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE9B22D1-338D-4B61-BEEA-62E445BE2D39", "versionEndExcluding": "5.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}