GHSA-r2r8-36pq-27cm
nzo/url-encryptor-bundle Insecure default secret key and IV allowing anyone to decrypt values
GHSA-r2r8-36pq-27cm is a vulnerability with no CVSS score yet in nzo/url-encryptor-bundle, published May 17, 2024. No source lists public exploit code. Fixed in nzo/url-encryptor-bundle 5.0.1.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
5.0.1nzo/url-encryptor-bundle +3 more
Description
Versions of nzo/url-encryptor-bundle prior to 5.0.1 and 4.3.2 are affected by a security vulnerability related to the lack of mandatory key and IV requirements. By default, the bundle uses the aes-256-ctr algorithm, which is susceptible to malleability attacks, potentially leading to Insecure Direct Object Reference (IDOR) vulnerabilities. Additionally, the reuse of keys enables users to decrypt and modify encrypted data if they can guess the plaintext of one ciphertext.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nzo/url-encryptor-bundlePackagist | 5.0.0 up to 5.0.1 | 5.0.1 |
nzo/url-encryptor-bundlePackagist | 4.0.0 up to 4.3.2 | 4.3.2 |
nzo/url-encryptor-bundlePackagist | 5.0.0 up to 5.0.1, plus listed versions v5.0.0 | 5.0.1 |
nzo/url-encryptor-bundlePackagist | 4.0.0 up to 4.3.2, plus listed versions 4.1.04.2.04.2.1v4.2.2v4.2.3v4.3.0v4.3.1 | 4.3.2 |
What each source reports
GitHub AdvisoriesNo score
nzo/url-encryptor-bundle Insecure default secret key and IV allowing anyone to decrypt values
Versions of nzo/url-encryptor-bundle prior to 5.0.1 and 4.3.2 are affected by a security vulnerability related to the lack of mandatory key and IV requirements. By default, the bundle uses the aes-256-ctr algorithm, which is susceptible to malleability attacks, potentially leading to Insecure Direct Object Reference (IDOR) vulnerabilities. Additionally, the reuse of keys enables users to decrypt and modify encrypted data if they can guess the plaintext of one ciphertext.
- Record
GHSA-r2r8-36pq-27cm- Updated
- 2026-11-02
OSVNo score
nzo/url-encryptor-bundle Insecure default secret key and IV allowing anyone to decrypt values
Versions of nzo/url-encryptor-bundle prior to 5.0.1 and 4.3.2 are affected by a security vulnerability related to the lack of mandatory key and IV requirements. By default, the bundle uses the aes-256-ctr algorithm, which is susceptible to malleability attacks, potentially leading to Insecure Direct Object Reference (IDOR) vulnerabilities. Additionally, the reuse of keys enables users to decrypt and modify encrypted data if they can guess the plaintext of one ciphertext.
- Record
GHSA-r2r8-36pq-27cm- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/nayzo/NzoUrlEncryptorBundle/commit/ba3af1a9bcf3bedcc0ed5948979f482e2134da1a