Home > Vulnerability Database > CVE-2021-3127

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2021-3127

Good to know:

Date: March 16, 2021

NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled.

Language: Go

Severity Score

7.5

Related Resources (12)

Url: https://security-tracker.debian.org/tracker/CVE-2021-3127

Url: https://github.com/nats-io/jwt/pull/149

Url: https://github.com/nats-io/nats-server/commit/423b79440c80c863de9f4e20548504e6c5d5e403

Url: https://github.com/nats-io/nats-server/security/advisories/GHSA-j756-f273-xhp4

Url: https://advisories.nats.io/CVE/CVE-2021-3127.txt

Url: https://github.com/nats-io/nats-server

Url: https://github.com/nats-io/jwt

Url: https://nvd.nist.gov/vuln/detail/CVE-2021-3127

Url: https://github.com/nats-io/jwt/security/advisories/GHSA-62mh-w5cv-p88c

Url: https://github.com/nats-io/jwt/pull/149/commits/a826c77dc9d2671c961b75ceefdb439c41029866

Url: https://github.com/nats-io/jwt/commit/6c72fdd73e82fa9ebb151d84773baf4e9164c4ab

Url: https://www.mend.io/vulnerability-database/CVE-2021-3127

Severity Score

7.5

Weakness Type (CWE)

Improper Access Control

CWE-284

Improper Handling of Exceptional Conditions

CWE-755

Incorrect Authorization

CWE-863

Top Fix

Upgrade Version

Upgrade to version github.com/nats-io/jwt/v2 - v2.0.1;github.com/nats-io/nats-server/v2 - v2.2.0

CVSS v3.1

Base Score:	7.5
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	NONE
Availability (A):	NONE

CVSS v2

Base Score:	5.0
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	NONE
Availability (A):	NONE
Additional information:

Do you need more information?

Contact Us