CVE-2023-32188

JWT token compromise can allow malicious actions including Remote Code Execution (RCE)

Published Oct 16, 2024 CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Description

A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

SUSE

neuvector

unaffected

Version	Status	Constraints
`0`	affected	< 0.0.0-20231003121714-be746957ee7c

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2023-2662	A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.
Github GHSA	GHSA-622h-h2p8-743x	JWT token compromise can allow malicious actions including Remote Code Execution (RCE)

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.588% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32188
https://github.com/neuvector/neuvector/security/advisories/GHSA-622h-h2p8-743x

History

Jul 12, 2025 1:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00167}`	epss `{'score': 0.00172}`

Oct 16, 2024 6:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Neuvector Neuvector neuvector
CPEs		cpe:2.3:a:neuvector:neuvector::::::::
Vendors & Products		Neuvector Neuvector neuvector
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 16, 2024 8:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.
Title		JWT token compromise can allow malicious actions including Remote Code Execution (RCE)
Weaknesses		CWE-1270
References		https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32188 https://github.com/neuvector/neuvector/security/advisories/GHSA-622h-h2p8-743x
Metrics		cvssV4_0 `{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}`