CVE-2023-22644

9.4 criticalEPSS 0.5%

Critical (9.4) in suse manager server. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in github.com/neuvector/neuvector 0.0.0-20231003121714-be746957ee7c.

A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.

Severity

CVSS 4.0

9.4 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS 3.1

5.5 medium

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
CWE: CWE-1270
Published: 2023-09-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

suse:manager_server

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GO-2024-3201	Go	github.com/neuvector/neuvector	<0.0.0-20231003121714-be746957ee7c	0.0.0-20231003121714-be746957ee7c

References

Check your stack JSON