Cisco Node-Jose vulnerabilities

3 CVEs affecting Cisco Node-Jose, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-25653, published 2023-02-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-0114, published 2018-01-04. High severity, CVSS 7.5. EPSS: 42.7% chance of exploitation in the next 30 days. A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The…
CVE-2017-16007, published 2018-06-04. Medium severity, CVSS 5.9. EPSS: 0.9% chance of exploitation in the next 30 days. node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers. node-jose earlier than version 0.9.3 is vulnerable to an…
CVE-2023-25653, published 2023-02-16. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for web browsers and node.js-based servers. Prior to version 2.2.0, when using the non-default "fallback"…