CVE-2021-32631

Katalog CVE

CVSS 6.5 · Medium EPSS 1,1%

Kerentanan Authentication Bypass by Spoofing pada nimble-project common. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Common is a package of common modules that can be accessed by NIMBLE services. Common before commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 did not properly verify the signature of JSON Web Tokens. This allows someone to forge a valid JWT. Being able to forge JWTs may lead to authentication bypasses. Commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 contains a patch for the issue. As a workaround, one may use the parseClaimsJws method to correctly verify the signature of a JWT.

Rincian

Terbit di NVD

26 Juli 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-290: Authentication Bypass by Spoofing

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nimble-platform/common/commit/12197a755bd524559bf4e16475595a2c6fcd34db patch · advisory pihak ketiga
• https://github.com/nimble-platform/common/commit/3b96cb0293d3443b870351945f41d7d55cb34b53 patch · advisory pihak ketiga
• https://github.com/nimble-platform/common/commit/a59ad46733912a5580530e39cac0e6ebc83cc563 patch · advisory pihak ketiga
• https://github.com/nimble-platform/common/security/advisories/GHSA-fjq8-896w-pv28 advisory pihak ketiga