PT-2021-17644 · Ymfe · Ymfe Yapi

Jarlob + 1 · Published 2021-03-01 · Updated 2021-03-26 · CVE-2021-27884

Positive Technologies (AI Summary)

CVSS v3.1

5.1

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: YMFE YApi versions 1.9.2 and earlier

Description: The issue arises from weak JSON Web Token (JWT) signing secret generation. This is due to the use of Math.random in Node.js, which does not provide cryptographically secure random numbers, allowing the recreation of other users' JWT tokens.

Recommendations: For versions 1.9.2 and earlier, update to version 1.9.3 to resolve the issue. As a temporary workaround, consider restricting access to sensitive operations that rely on JWT tokens until the update can be applied.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2021-27884

GHSA-2H3H-VW8R-82RP

Affected Products

Ymfe Yapi

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-27884 · Security Note
• https://osv.dev/vulnerability/GHSA-2h3h-vw8r-82rp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27884 · Vendor Advisory
• https://github.com/YMFE/yapi/issues/2117 · Note
• https://github.com/YMFE/yapi/issues/2263 · Note
• https://securitylab.github.com/advisories/GHSL-2020-228-YMFE-yapi · Note
• https://t.me/cibsecurity/24317 · Telegram Post