GitHub Advisoryadvisory · npm

GHSA-2h3h-vw8r-82rp Weak JSON Web Token in yapi-vendor

MEDIUM Published 2021-03-26 Modified 2021-07-22 Official page ↗
Aliases
CVE-2021-27884
Ecosystem
npm
Packages
yapi-vendor
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-330
Reviewed
2021-03-26

Affected packages

• npm yapi-vendor: < 1.9.3 → fixed in 1.9.3

Description

Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used as a source of randomness in jwt signing. Math.random does not provide cryptographically secure random numbers. This has been patched in version 1.9.3.

Related

Alias · CVE (1)

  • CVE-2021-27884 Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. vulnerability

Weakness · CWE (1)

  • CWE-330 Use of Insufficiently Random Values weakness

References