PT-2023-12162 · Mosn · Mosn

Ruil1N · Publicado 2023-02-17 · Atualizado 2025-03-18 · CVE-2021-32163

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MOSN versions prior to 0.23.0

Description The issue allows an attacker to escalate privileges via case-sensitive JWT authorization, potentially leading to unauthorized access. This is related to an authentication vulnerability.

Recommendations For MOSN versions prior to 0.23.0, update to version 0.23.0 or later to resolve the issue. As a temporary workaround, consider restricting access to JWT authorization until the update is applied.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-178

CWE-863

Identificadores relacionados

CVE-2021-32163

GHSA-5VX9-J5CW-47VQ

GO-2023-1582

Produtos afetados

Mosn

Referências · 10

• 🔥 https://github.com/mosn/mosn/issues/1633 · Exploit
• https://github.com/mosn/mosn/pull/1637 · Correção
• https://github.com/mosn/mosn · Nota
• https://github.com/advisories/GHSA-5vx9-j5cw-47vq · Nota
• https://osv.dev/vulnerability/GO-2023-1582 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-5vx9-j5cw-47vq · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2021-32163 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2021-32163 · Nota de Segurança
• https://t.me/cvenotify/115261 · Publicação no Telegram
• https://t.me/cibsecurity/58466 · Publicação no Telegram