CVE-2024-31033 describes a potential issue in JJWT (Java JWT) versions through 0.12.5, specifically within the setSigningKey() and signWith() methods, where certain characters might be ignored, leading users to believe they have a stronger key than is actually in use. The vendor disputes this, attributing the behavior to user error and an outdated test version. With a CVSS score of 6.8 (Medium), this vulnerability has a network attack vector, high attack complexity, and could lead to high confidentiality and integrity impacts if exploited, though user interaction is required. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| N/A | N/A | n/aCNA affected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.2 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.