How severe is CVE-2021-4314?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 5.3 out of 10.

What type of vulnerability is CVE-2021-4314?

This is classified as CWE-269, which is a common weakness in software security.

CVE-2021-4314 - MEDIUM Severity | CVSS 5.3

Vulnerability Description

It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only in the situation when zOSMF doesn’t have the APAR PH12143 applied. This issue affects: 1.16 versions to 1.19. What happens is that the services using the ZAAS client or the API ML API to query will be deceived into believing the information in the JWT token is valid when it isn’t. It’s possible to use this to persuade the southbound service that different user is authenticated.

Related Vulnerabilities

CVE-2012-1104

MEDIUM

CVSS:5.3(Medium)

A Security Bypass vulnerability exists in the phpCAS 1.2.2 library from the jasig project due to the way proxying of services are managed.

CWE-2692012

CVE-2015-8032

MEDIUM

CVSS:5.3(Medium)

In Textpattern 4.5.7, an unprivileged author can change an article's markup setting.

CWE-2692015

CVE-2017-0360

MEDIUM

CVSS:5.3(Medium)

file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a "same root name but with a suffix" attack. NOTE: This vulnerabili...

CWE-2692017

CVE-2017-7782

MEDIUM

CVSS:5.3(Medium)

An error in the "WindowsDllDetourPatcher" where a RWX ("Read/Write/Execute") 4k block is allocated but never protected, violating DEP protections. Note: This attack only affects Windows operating syst...

CWE-2692017

CVE-2017-9662

MEDIUM

CVSS:5.3(Medium)

An Improper Privilege Management issue was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0. Monitouch V-SFT is installed in a directory with weak access controls by defa...

CWE-2692017

CVE-2018-0573

MEDIUM

CVSS:5.3(Medium)

baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction for a content to view a file which is uploaded by a site use...

CWE-2692018