PT-2023-12162 · Mosn · Mosn

Ruil1N · Published 2023-02-17 · Updated 2025-03-18 · CVE-2021-32163

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MOSN versions prior to 0.23.0

Description The issue allows an attacker to escalate privileges via case-sensitive JWT authorization, potentially leading to unauthorized access. This is related to an authentication vulnerability.

Recommendations For MOSN versions prior to 0.23.0, update to version 0.23.0 or later to resolve the issue. As a temporary workaround, consider restricting access to JWT authorization until the update is applied.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-178

CWE-863

Related Identifiers

CVE-2021-32163

GHSA-5VX9-J5CW-47VQ

GO-2023-1582

Affected Products

Mosn

References · 10

• 🔥 https://github.com/mosn/mosn/issues/1633 · Exploit
• https://github.com/mosn/mosn/pull/1637 · Patch
• https://osv.dev/vulnerability/GO-2023-1582 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5vx9-j5cw-47vq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32163 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32163 · Security Note
• https://github.com/mosn/mosn · Note
• https://github.com/advisories/GHSA-5vx9-j5cw-47vq · Note
• https://t.me/cvenotify/115261 · Telegram Post
• https://t.me/cibsecurity/58466 · Telegram Post