CVE:CVE-2022-31053
CNNVD:CNNVD-202206-1199
Biscuit是委托的、去中心化的、基于能力的授权令牌。
Biscuit v1 版本存在数据伪造问题漏洞，该漏洞源于允许攻击者创建具有任何访问级别的令牌。
solution:Upgrade biscuitsec biscuit-auth to a higher version than 1.1.0,and avoid the version [1.0.0,1.1.0]; Upgrade biscuitsec biscuit-go to a higher version than 2.0.0,and avoid the version (,2.0.0); Upgrade biscuitsec biscuit-haskell to a higher version than 0.1.1.0,and avoid the version 0.1.1.0; Upgrade clever-cloud biscuit-java to a higher version than 2.0.0,and avoid the version (,2.0.0)