Vulnerability	Vulnerable Version
C Information Exposure Through Log Files Affected versions of this package are vulnerable to Information Exposure Through Log Files due to the misconfiguration of the `x-jwt-token` header. An attacker can retrieve personal information or execute unauthorized requests by intercepting network traffic to access the exposed token. Notes: The following conditions have to be met in order to perform this attack: An attacker needs to have access to the network traffic on the api.form.io domain. The content of the `x-jwt-token` header is logged or otherwise available to the attacker. An attacker needs to have network access to the Valtimo API. An attacker needs to act within the time-to-live of the access token. The default TTL in Keycloak is 5 minutes. How to fix Information Exposure Through Log Files? Upgrade `@valtimo/components` to version 10.8.4, 11.1.6, 11.2.2 or higher.	<10.8.4>=11.0.0 <11.1.6>=11.2.0 <11.2.2

Information Exposure Through Log Files

Affected versions of this package are vulnerable to Information Exposure Through Log Files due to the misconfiguration of the x-jwt-token header. An attacker can retrieve personal information or execute unauthorized requests by intercepting network traffic to access the exposed token.

Notes:

The following conditions have to be met in order to perform this attack:

An attacker needs to have access to the network traffic on the api.form.io domain.
The content of the x-jwt-token header is logged or otherwise available to the attacker.
An attacker needs to have network access to the Valtimo API.
An attacker needs to act within the time-to-live of the access token. The default TTL in Keycloak is 5 minutes.

How to fix Information Exposure Through Log Files?

Upgrade @valtimo/components to version 10.8.4, 11.1.6, 11.2.2 or higher.

<10.8.4>=11.0.0 <11.1.6>=11.2.0 <11.2.2

Go back to all versions of this package