CVE-2021-4314
Last modified
CVE-2021-4314 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only in the situation when zOSMF doesn’t have the APAR PH12143 applied. EPSS estimates a 0.44% chance of exploitation in the next 30 days.
Description
It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only in the situation when zOSMF doesn’t have the APAR PH12143 applied. This issue affects: 1.16 versions to 1.19. What happens is that the services using the ZAAS client or the API ML API to query will be deceived into believing the information in the JWT token is valid when it isn’t. It’s possible to use this to persuade the southbound service that different user is authenticated.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Linuxfoundation | Zowe Api Mediation Layer | >= 1.16.0, < 1.19.0 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-4314?
How severe is CVE-2021-4314?
How do I fix CVE-2021-4314?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-43129A bypass exists for Desire2Learn/D2L Brightspace’s “Disable …6.5
- CVE-2021-4313A vulnerability was found in NethServer phonenehome. It has …9.8
- CVE-2021-43130An SQL Injection vulnerability exists in Sourcecodester Cust…9.8
- CVE-2021-43136An authentication bypass issue in FormaLMS <= 2.4.4 allows a…9.8
- CVE-2021-43137Cross-Site Scripting (XSS) and Cross-Site Request Forgery (C…8.8
- CVE-2021-43138In Async before 2.6.4 and 3.x before 3.2.2, a malicious user…7.8
- CVE-2021-43140SQL Injection vulnerability exists in Sourcecodester. Simple…9.8
- CVE-2021-43141Cross Site Scripting (XSS) vulnerability exists in Sourcecod…6.1
- CVE-2021-43142An XML External Entity (XXE) vulnerability exists in wuta jo…9.8
- CVE-2021-43145With certain LDAP configurations, Zammad 5.0.1 was found to …8.1
- CVE-2021-43149Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2021-4315A vulnerability has been found in NYUCCL psiTurk up to 3.2.0…8.8
Are you affected by CVE-2021-4314?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST