Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.tomee:mp-jwt

3 known vulnerabilities (1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3 · 1 low
Registry
Maven Central

Advisories 3

  • Apache TomEE: Privilege escalation via leaked MicroProfile JWT run-as identity

    Affected: from 8.0.0-M2, fixed in 10.0.0-M1; from 10.0.0-M1, fixed in 10.3.0; from 11.0.0-M1, fixed in 11.0.0-M2.

  • Apache TomEE: Expired MicroProfile JWT tokens accepted with negative clock skew

    Affected: from 10.0.0-M1, fixed in 10.3.0; from 11.0.0-M1, fixed in 11.0.0-M2.

  • Apache TomEE: Authorization bypass in MicroProfile JWT role checks for JAX-RS resources

    Affected: from 7.1.0, fixed in 10.0.0-M1; from 10.0.0-M1, fixed in 10.3.0; from 11.0.0-M1, fixed in 11.0.0-M2.