PatchTheCVEcryptospike vulnerabilities and fixes
Recent CVEs affecting cryptospike, with upgrade or downgrade steps. 9 tracked.
cryptospike has 9 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 0. Most recent: 2023-12-12. Highest priority: CVE-2023-36655 (score 60/100).
- CVE-2023-36655 CRITICAL 9.8 DOWNGRADE The login REST API in ProLion CryptoSpike 3.0.15P2 (when LDAP or Active Directory is used as the users store)
- CVE-2023-36654 MEDIUM 6.5 DOWNGRADE Directory traversal in the log-download REST API endpoint in ProLion CryptoSpike 3.0.15P2 allows remote authen
- CVE-2023-36652 MEDIUM 4.3 DOWNGRADE A SQL Injection in the users searching REST API endpoint in ProLion CryptoSpike 3.0.15P2 allows remote authent
- CVE-2023-36651 HIGH 7.2 DOWNGRADE Hidden and hard-coded credentials in ProLion CryptoSpike 3.0.15P2 allow remote attackers to login to web manag
- CVE-2023-36650 HIGH 7.2 DOWNGRADE A missing integrity check in the update system in ProLion CryptoSpike 3.0.15P2 allows attackers to execute OS
- CVE-2023-36649 CRITICAL 9.1 DOWNGRADE Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2
- CVE-2023-36648 HIGH 8.2 DOWNGRADE Missing authentication in the internal data streaming system in ProLion CryptoSpike 3.0.15P2 allows remote una
- CVE-2023-36647 HIGH 7.5 DOWNGRADE A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2
- CVE-2023-36646 HIGH 8.8 DOWNGRADE Incorrect user role checking in multiple REST API endpoints in ProLion CryptoSpike 3.0.15P2 allows a remote at
FAQ
How do I fix cryptospike vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is cryptospike being exploited right now?
None of the tracked cryptospike CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which cryptospike CVE should I patch first?
CVE-2023-36655 currently ranks highest (60/100): The login REST API in ProLion CryptoSpike 3.0.15P2 (when LDAP or Active Directory is used as the users store) .