[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fh2m6mssqmm72SqdsVES0Js8-oGK-BQIYN1KwgqX-8fU":3,"g5a-risk:CVE-2023-27584":129},{"success":4,"data":5,"meta":126},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":37,"epssPercentile":27,"epssTimeSeries":38,"severity":39,"affectedProducts":40,"affectedProductsCount":46,"references":47,"referencesCount":58,"weaknesses":59,"weaknessesCount":58,"isActivelyExploited":74,"cisaInfo":27,"otxData":27,"relatedBlogPosts":75,"seoMetadata":76,"configurations":101,"relatedVendorCves":110,"notableEvents":111},"CVE-2023-27584","What is CVE-2023-27584?","Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation (CNCF) as an Incubating Level Project. Dragonfly uses JWT to verify user. However, the secret key for JWT, \"Secret Key\", is hard coded, which leads to authentication bypass. An attacker can perform any action as a user with admin privileges. This issue has been addressed in release version 2.0.9. All users are advised to upgrade. There are no known workarounds for this vulnerability.","Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation (CNCF) as an Inc...","2024-09-19T23:15:11.233","2026-06-17T05:45:31.27",9.8,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":34,"CVSSMetricV2":35,"CVSSMetricV40":36},[16,30],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":28,"ImpactScore":29},"security-advisories@github.com","Secondary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":25,"IntegrityImpact":25,"AvailabilityImpact":25,"BaseScore":12,"BaseSeverity":26,"ExploitCodeMaturity":27,"RemediationLevel":27,"ReportConfidence":27,"TemporalScore":27,"TemporalSeverity":27,"ConfidentialityRequirement":27,"IntegrityRequirement":27,"AvailabilityRequirement":27,"ModifiedAttackVector":27,"ModifiedAttackComplexity":27,"ModifiedPrivilegesRequired":27,"ModifiedUserInteraction":27,"ModifiedScope":27,"ModifiedConfidentialityImpact":27,"ModifiedIntegrityImpact":27,"ModifiedAvailabilityImpact":27,"EnvironmentalScore":27,"EnvironmentalSeverity":27},"3.1","NETWORK","LOW","NONE","UNCHANGED","HIGH","CRITICAL",null,3.9,5.9,{"Source":31,"Type":32,"CVSSData":33,"ExploitabilityScore":28,"ImpactScore":29},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":25,"IntegrityImpact":25,"AvailabilityImpact":25,"BaseScore":12,"BaseSeverity":26,"ExploitCodeMaturity":27,"RemediationLevel":27,"ReportConfidence":27,"TemporalScore":27,"TemporalSeverity":27,"ConfidentialityRequirement":27,"IntegrityRequirement":27,"AvailabilityRequirement":27,"ModifiedAttackVector":27,"ModifiedAttackComplexity":27,"ModifiedPrivilegesRequired":27,"ModifiedUserInteraction":27,"ModifiedScope":27,"ModifiedConfidentialityImpact":27,"ModifiedIntegrityImpact":27,"ModifiedAvailabilityImpact":27,"EnvironmentalScore":27,"EnvironmentalSeverity":27},[],[],[],0.33874,[37,37,37,37,37,37,37],"Critical",[41],{"vendor":42,"product":43,"version":44,"criteria":45,"vulnerable":4},"linuxfoundation","dragonfly","*","cpe:2.3:a:linuxfoundation:dragonfly:*:*:*:*:*:go:*:*",1,[48,53],{"url":49,"source":50,"tags":51},"https:\u002F\u002Fgithub.com\u002Fdragonflyoss\u002FDragonfly2\u002Freleases\u002Ftag\u002Fv2.0.9","GitHub",[52],"Release Notes",{"url":54,"source":50,"tags":55},"https:\u002F\u002Fgithub.com\u002Fdragonflyoss\u002FDragonfly2\u002Fsecurity\u002Fadvisories\u002FGHSA-hpc8-7wpm-889w",[56,57],"Exploit","Vendor Advisory",2,[60,68],{"id":61,"name":62,"description":63,"extendedDescription":64,"status":65,"abstraction":66,"structure":67},"CWE-321","Use of Hard-coded Cryptographic Key","The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.","","Draft","Variant","Simple",{"id":69,"name":70,"description":71,"extendedDescription":72,"status":65,"abstraction":73,"structure":67},"CWE-798","Use of Hard-coded Credentials","The product contains hard-coded credentials, such as a password or cryptographic key.","There are two main variations:","Base",false,[],{"title":77,"metaDescription":78,"keywords":79,"canonicalUrl":80,"structuredData":81},"What is CVE-2023-27584? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2023-27584, a critical severity cyber security vulnerability from 2024. High exploit probability (33.9%). Dragonfly is an open ...","CVE-2023-27584, CVE-2023-27584 vulnerability, CVE-2023-27584 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2024, CVSS score, exploit, patch, remediation, linuxfoundation security, dragonfly vulnerability, high risk vulnerability, actively exploited, exploit available","\u002Fwhat-is\u002Fcve-2023-27584",{"@context":82,"@type":83,"headline":77,"description":78,"datePublished":10,"dateModified":11,"author":84,"publisher":88,"about":92,"mainEntityOfPage":96,"articleSection":99,"keywords":100},"https:\u002F\u002Fschema.org","TechArticle",{"@type":85,"name":86,"url":87},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":85,"name":86,"url":87,"logo":89},{"@type":90,"url":91},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":93,"name":6,"description":94,"additionalType":95},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":97,"@id":98},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2023-27584","Cybersecurity","CVE-2023-27584, CVE-2023-27584 vulnerability, CVE-2023-27584 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[102],{"Operator":27,"Negate":27,"Nodes":103},[104],{"Operator":105,"Negate":74,"CPEMatch":106},"OR",[107],{"Vulnerable":4,"Criteria":45,"MatchCriteriaID":108,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":109,"VersionEndIncluding":27},"72F934F8-8793-41F8-9D9E-8D1B545683A6","2.0.9",[],[112,119],{"id":113,"eventType":114,"eventTime":115,"details":116,"label":117,"color":118},"ff48c90b-33f5-4ad8-abb0-dc293084489a","LOW_EPSS_DELTA","2025-06-11T10:10:20.448763+00:00","Daily EPSS score decreased by 0.124 on 2024-09-20","EPSS Score Decreased","green",{"id":120,"eventType":121,"eventTime":122,"details":123,"label":124,"color":125},"ea68f0cf-eb7f-4765-bf29-cd71408d02d1","HIGH_EPSS_DELTA","2025-06-17T10:24:06.15301+00:00","Daily EPSS score increased by 0.211 on 2024-09-20","EPSS Score Increased","red",{"lastModified":11,"cacheTime":127,"version":128},1792432920714,"2.0",{"score":130,"band":131,"action":132,"scoredAt":133},62,"Medium","Plan remediation","2026-10-16T07:03:52.613192+00:00"]