Lucene search

[email protected]NVD:CVE-2021-27306

HistoryMar 18, 2021 - 3:15 p.m.

CVE-2021-27306

2021-03-1815:15:16

CWE-706

[email protected]

web.nvd.nist.gov

vulnerability

access control

jwt plugin

kong gateway

unauthenticated users

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

55.1%

JSON

An improper access control vulnerability in the JWT plugin in Kong Gateway prior to 2.3.2.0 allows unauthenticated users access to authenticated routes without a valid token JWT.

Affected configurations

Nvd

Node

konghqkong_gatewayRange<2.3.2.0enterprise

VendorProductVersionCPE
konghqkong_gateway*cpe:2.3:a:konghq:kong_gateway:*:*:*:*:enterprise:*:*:*

Vendor	Product	Version	CPE
konghq	kong_gateway	*	cpe:2.3:a:konghq:kong_gateway:::::enterprise:::*

References

docs.konghq.com/enterprise/changelog/#core-1

medium.com/%40sew.campos/cve-2021-27306-access-an-authenticated-route-on-kong-api-gateway-6ae3d81968a3

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

55.1%

JSON

Related for NVD:CVE-2021-27306

cvelist1 cve1 prion1