by Kastro
Paper/Archive/CVE-2021-37580

CVE-2021-37580

Apache Software Foundation Apache ShenYu Admin — Apache ShenYu Admin bypass JWT authentication

EPSS 42%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 98.7.987 × 2019.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0

Affected

ProductAffectedFixed inSource
Apache ShenYu AdminApache ShenYu Admin 2.3.0-2.4.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reflists.apache.org/thread/o15j25qwtpcw62k48xw1tnv48skh3zgbrefopenwall.com/lists/oss-security/2021/11/16/1