CVE-2022-44796

An issue was discovered in Object First Ootbi BETA build 1.0.7.712. The authorization service has a flow that allows getting access to the Web UI without knowing credentials. For signing, the JWT token uses a secret key that is generated through a function that doesn't produce cryptographically strong sequences. An attacker can predict these sequences and generate a JWT token. As a result, an attacker can get access to the Web UI. This is fixed in Object First Ootbi BETA build 1.0.13.1611.

An issue was discovered in Object First Ootbi BETA build 1.0.7.712. The authorization service has a flow that allows getting access to the Web UI without knowing credentials. For signing, the JWT token uses a secret key that is generated through a function that doesn't produce cryptographically strong sequences. An attacker can predict these sequences and generate a JWT token. As a result, an attacker can get access to the Web UI. This is fixed in Object First Ootbi BETA build 1.0.13.1611.

Se descubrió un problema en la compilación 1.0.7.712 de Object First Ootbi BETA. El servicio de autorización tiene un flujo que permite acceder a la interfaz de usuario web sin conocer las credenciales. Para firmar, el token JWT utiliza una clave secreta que se genera a través de una función que no produce secuencias criptográficamente fuertes. Un atacante puede predecir estas secuencias y generar un token JWT. Como resultado, un atacante puede obtener acceso a la interfaz de usuario web. Esto se solucionó en la compilación 1.0.13.1611 de Object First Ootbi BETA.