CVE-2019-17195 | SynScan

Vulnerability Database

289,599

Total vulnerabilities in the database

CVE-2019-17195

Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.

Published: Oct 15, 2019
Updated: Nov 8, 2023
CVE: CVE-2019-17195
GHSA: GHSA-f6vf-pq8c-69m4
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: Medium
Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P

CWEs:

Affected Software
References

Software	From	Fixed in
connect2id / nimbus_jose+jwt	-	7.9
apache / hadoop	3.2.1	3.2.1.x
oracle / solaris_cluster	4.0	4.0.x
oracle / weblogic_server	12.2.1.3.0	12.2.1.3.0.x
oracle / weblogic_server	12.2.1.4.0	12.2.1.4.0.x
oracle / peoplesoft_enterprise_peopletools	8.58	8.58.x
oracle / enterprise_manager_base_platform	13.4.0.0	13.4.0.0.x
oracle / primavera_gateway	19.12.0	19.12.0.x
oracle / data_integrator	12.2.1.4.0	12.2.1.4.0.x
oracle / peoplesoft_enterprise_peopletools	8.59	8.59.x
oracle / primavera_gateway	18.8.0	18.8.11.x
oracle / communications_pricing_design_center	12.0.0.3.0	12.0.0.3.0.x
oracle / jd_edwards_enterpriseone_tools	-	9.2.5.3.x
oracle / policy_automation	12.2.0	12.2.22.x
oracle / communications_cloud_native_core_security_edge_protection_proxy	1.7.0	1.7.0.x
oracle / insurance_policy_administration	11.0	11.3.1.x
oracle / healthcare_data_repository	8.1.0	8.1.0.x
oracle / jd_edwards_enterpriseone_orchestrator	-	9.2.5.3.x
com.nimbusds / nimbus-jose-jwt	-	7.9