CVE-2023-36649 is a critical vulnerability affecting ProLion CryptoSpike 3.0.15P2, allowing sensitive JWT tokens to be logged in the centralized Grafana system. This flaw enables remote attackers to impersonate users in both web management and the REST API by accessing these tokens, either as an authenticated Grafana user or unauthenticated via the Loki REST API. With a CVSS score of 9.1 (Critical), the vulnerability has a network attack vector, low complexity, and high impact on confidentiality and integrity. Currently, there is no public exploit code available, no evidence of active exploitation, and minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
3.0.15CPE matchmatch criteria | cpe:2.3:a:prolion:cryptospike:3.0.15:p2:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.