CVE Vulnerability

CVE-2021-27884

Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used.

3.6 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

Scope

5.1 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.5 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/YMFE/yapi/issues/2117 Third Party Advisory
https://securitylab.github.com/advisories/GHSL-2020-228-YMFE-yapi Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:ymfe:yapi:*:*:*:*:*:*:*:*
Information

Published : 2021-03-01 11:15

Updated : 2021-03-08 04:24

NVD link : CVE-2021-27884

Mitre link : CVE-2021-27884

Products Affected
No products.
CWE
CWE-330