Vulnerability · Published Jul 15, 2022 · Assigned by GitHub_M
CVE-2022-31158Authentication Bypass by Capture-replay in packbackbooks/lti-1-3-php-library
High 7.5
In plain English
A high-severity security flaw in lti-1-3-php-library from packbackbooks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the Nonce Claim Value was not being validated against the nonce value sent in the Authentication Request. Users should upgrade to version 5.0 to receive a patch. There are currently no known workarounds.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | packbackbooks/lti-1-3-php-library | 5.0 | GHSA-5p73-qg2v-383h |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| packbackbooks | lti-1-3-php-library | < 5.0 |
Weakness: CWE-294 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N