CVE-2021-32631CWE-290

JSON Web Tokens not properly verified

Medium · published July 26, 2021

CVSS v3.1
6.5
EPSS
1%
Percentile
65.1
In the wild
Unconfirmed
What it is

Common is a package of common modules that can be accessed by NIMBLE services. Common before commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 did not properly verify the signature of JSON Web Tokens. This allows someone to forge a valid JWT. Being able to forge JWTs may lead to authentication bypasses. Commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 contains a patch for the issue. As a workaround, one may use the parseClaimsJws method to correctly verify the signature of a JWT.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01090 · 65.1th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2021-07-26T15:20Z
EPSS history
Timeline
  • 26 JUL 15:20Z
    JSON Web Tokens not properly verified
    cvelistv5