CVE-2021-32631 — MEDIUM (6.5)

Vulnerability Description

Common is a package of common modules that can be accessed by NIMBLE services. Common before commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 did not properly verify the signature of JSON Web Tokens. This allows someone to forge a valid JWT. Being able to forge JWTs may lead to authentication bypasses. Commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 contains a patch for the issue. As a workaround, one may use the parseClaimsJws method to correctly verify the signature of a JWT.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Nimble-Project	Common	-

Related Weaknesses (CWE)

CWE-290

References

https://github.com/nimble-platform/common/commit/12197a755bd524559bf4e16475595a2PatchThird Party Advisory
https://github.com/nimble-platform/common/commit/3b96cb0293d3443b870351945f41d7dPatchThird Party Advisory
https://github.com/nimble-platform/common/commit/a59ad46733912a5580530e39cac0e6ePatchThird Party Advisory
https://github.com/nimble-platform/common/security/advisories/GHSA-fjq8-896w-pv2Third Party Advisory
https://github.com/nimble-platform/common/commit/12197a755bd524559bf4e16475595a2PatchThird Party Advisory
https://github.com/nimble-platform/common/commit/3b96cb0293d3443b870351945f41d7dPatchThird Party Advisory
https://github.com/nimble-platform/common/commit/a59ad46733912a5580530e39cac0e6ePatchThird Party Advisory
https://github.com/nimble-platform/common/security/advisories/GHSA-fjq8-896w-pv2Third Party Advisory

FAQ

What is CVE-2021-32631?

CVE-2021-32631 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Common is a package of common modules that can be accessed by NIMBLE services. Common before commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 did not properly verify the signature of JSON Web To...

How severe is CVE-2021-32631?

CVE-2021-32631 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-32631?

Check the references section above for vendor advisories and patch information. Affected products include: Nimble-Project Common.