CVE-2021-4314
Medium
Description
It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only in the situation when zOSMF doesn’t have the APAR PH12143 applied. This issue affects: 1.16 versions to 1.19. What happens is that the services using the ZAAS client or the API ML API to query will be deceived into believing the information in the JWT token is valid when it isn’t. It’s possible to use this to persuade the southbound service that different user is authenticated.
SeverityMedium
CVSS5.3
Exploit probability—
ProductLinuxfoundation Zowe Api Mediation Layer
PublishedJan 18, 2023
First seenJan 18, 2023
Weakness typeCWE-269Improper privilege management
How to fix
Update
- linuxfoundation zowe_api_mediation_layer1.19.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linuxfoundation zowe_api_mediation_layer | 1.16.0 ≤ v < 1.19.0 | 1.19.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.