CVE-2021-31590

Katalog CVE

CVSS 8.8 · High EPSS 2,7%

Kerentanan pada pwndoc project pwndoc. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his admin privileges even if he is downgraded to the "user" privilege. Even after a user's account is deleted, the user can still access the administration panel (and add or delete users) and has complete access to the system.

Rincian

Terbit di NVD

19 Juli 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

EPSS (30 hari)

2,7% peluang dieksploitasi; lebih tinggi dari 85,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pwndoc/pwndoc/blob/59519735b0d831d8fd96d7c3387f66d28407e583/CHANGELOG.md#040-2021-08-23 patch · release notes · advisory pihak ketiga
• https://github.com/pwndoc/pwndoc/commit/15f3dc0e212eda465e05fda0feb002d1bce2939d patch · advisory pihak ketiga
• https://github.com/pwndoc/pwndoc/commit/ff1b868cec55f5b6c7a91e15a2b0b1f4324121ab patch · advisory pihak ketiga
• https://github.com/pwndoc/pwndoc/pull/128 patch · advisory pihak ketiga
• https://github.com/pwndoc/pwndoc/pull/74 patch · advisory pihak ketiga
• https://www.dgc.org/responsible_disclosure_pwndoc_jwt exploit · advisory pihak ketiga
• https://github.com/pwndoc/pwndoc/security/advisories broken link