CVE-2021-31590
High
Description
PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his admin privileges even if he is downgraded to the "user" privilege. Even after a user's account is deleted, the user can still access the administration panel (and add or delete users) and has complete access to the system.
SeverityHigh
CVSS8.8
Exploit probability—
ProductPwndoc
PublishedJul 19, 2021
First seenJul 19, 2021
How to fix
Update
- pwndoc_project pwndoc0.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pwndoc_project pwndoc | v < 0.4.0 | 0.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.