CVE-2021-47663 | THREATINT

Description

Due to improper JSON Web Tokens implementation an unauthenticated remote attacker can guess a valid session ID and therefore impersonate a user to gain full access.

PUBLISHED Reserved 2025-03-17 | Published 2025-04-24 | Updated 2025-04-24 | Assigner CERTVDE

HIGH: 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-613: Insufficient Session Expiration

Product status

Default status

unaffected

0.0.0 (semver)

affected

Credits

Siegfried Hollerer by TU Wien finder

References

www.sciencedirect.com/science/article/pii/S2351978921001657

cve.org (CVE-2021-47663)

nvd.nist.gov (CVE-2021-47663)

Download JSON