Vulnerability Description
LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the Nonce Claim Value was not being validated against the nonce value sent in the Authentication Request. Users should upgrade to version 5.0 to receive a patch. There are currently no known workarounds.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Packback | Lti 1.3 Tool Library | < 5.0.0 |
Related Weaknesses (CWE)
References
- https://github.com/packbackbooks/lti-1-3-php-library/security/advisories/GHSA-5pThird Party Advisory
- https://github.com/packbackbooks/lti-1-3-php-library/security/advisories/GHSA-5pThird Party Advisory
FAQ
What is CVE-2022-31158?
CVE-2022-31158 is a vulnerability with a CVSS score of 7.5 (HIGH). LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the Nonce Claim Value was not being validated against the nonce value sent in the...
How severe is CVE-2022-31158?
CVE-2022-31158 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-31158?
Check the references section above for vendor advisories and patch information. Affected products include: Packback Lti 1.3 Tool Library.