CVE-2021-27884

low-risk

Published 2021-03-01

Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used.

Do I need to act?

0.06% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.1/10 Medium

LOCAL / LOW complexity

Affected Products (1)

Yapi

Affected Vendors

Ymfe

References (4)

Third Party Advisory https://github.com/YMFE/yapi/issues/2117

Third Party Advisory https://securitylab.github.com/advisories/GHSL-2020-228-YMFE-yapi

Third Party Advisory https://github.com/YMFE/yapi/issues/2117

Third Party Advisory https://securitylab.github.com/advisories/GHSL-2020-228-YMFE-yapi

/ 100

low-risk

Severity 17/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal