CVE-2020-37281: fallo crítico en Gravitee API Management
Gravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.2epss 0.9%
Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject and present it as a bearer token to the Management API, impersonating administrators to gain full platform control.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
Gravitee · Gravitee API ManagementReferencias
https://github.com/gravitee-io/gravitee-api-management/blob/4.12.22/gravitee-apim-rest-api/gravitee-apim-rest-api-management/gravitee-apim-rest-api-management-security/src/main/java/io/gravitee/rest/api/management/security/config/BasicSecurityConfigurerAdapter.java#L157-L175https://github.com/gravitee-io/gravitee-api-management/blob/4.12.22/gravitee-apim-rest-api/gravitee-apim-rest-api-standalone/gravitee-apim-rest-api-standalone-distribution/src/main/resources/config/gravitee.yml#L636-L637https://github.com/gravitee-io/gravitee-api-management/blob/4.12.22/helm/values.yaml#L103https://github.com/gravitee-io/gravitee-docs/blob/master/pages/apim/3.x/how-tos/how-to-general-configuration.adochttps://github.com/gravitee-io/issues/issues/4204https://www.vulncheck.com/advisories/gravitee-api-management-through-4.12.22-default-jwt-secret-authentication-bypass