VulnerabilityModified

CVE-2022-31158

LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP.

HIGH 7.5EPSS 0.83%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.83%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the Nonce Claim Value was not being validated against the nonce value sent in the Authentication Request. Users should upgrade to version 5.0 to receive a patch. There are currently no known workarounds.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS: 0.83% probability · 56th percentile
CISA KEV: Not listed
Weakness: CWE-294
Affected: packback/lti 1.3 tool library
Source: security-advisories@github.com

References

https://github.com/packbackbooks/lti-1-3-php-library/security/advisories/GHSA-5p73-qg2v-383hThird Party Advisory
https://github.com/packbackbooks/lti-1-3-php-library/security/advisories/GHSA-5p73-qg2v-383hThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.