PT-2021-17644
CVE-2021-27884
·
تاريخ النشر
2021-03-01
·
تاريخ التحديث
2021-03-26
الوصف من
CVSS 3.1
5.1
متوسطةالمقاييسAV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions:
YMFE YApi versions 1.9.2 and earlier
Description:
The issue arises from weak JSON Web Token (JWT) signing secret generation. This is due to the use of
Math.random in Node.js, which does not provide cryptographically secure random numbers, allowing the recreation of other users' JWT tokens.Recommendations:
For versions 1.9.2 and earlier, update to version 1.9.3 to resolve the issue. As a temporary workaround, consider restricting access to sensitive operations that rely on JWT tokens until the update can be applied.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾