Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2021-27884

Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used.

VectorLOCAL

PublishedMar 01, 2021, 23:15

Published Bycve@mitre.org

Base Score

Score5.1

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

yapi-vendor(npm)01.9.3N/A

References

https://github.com/YMFE/yapi/issues/2117
https://securitylab.github.com/advisories/GHSL-2020-228-YMFE-yapi

Weakness Type

CWE-330

CVSS Metrics

Base Score

5.1

Vector String

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

LOCAL