GHSA-cpcr-74q9-74gp
Suggest an improvement- Source
- https://github.com/advisories/GHSA-cpcr-74q9-74gp
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-cpcr-74q9-74gp/GHSA-cpcr-74q9-74gp.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-cpcr-74q9-74gp
- Aliases
-
- CVE-2021-26074
- Published
- 2021-05-10T15:19:04Z
- Modified
- 2023-11-08T04:05:20.046006Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- Broken Authentication in Atlassian Connect Spring Boot
- Details
-
Broken Authentication in Atlassian Connect Spring Boot (ACSB) from version 1.1.0 before version 2.1.3. Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Spring Boot versions between 1.1.0 - 2.1.2 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.
- Database specific
{ "nvd_published_at": "2021-04-16T03:15:00Z", "github_reviewed_at": "2021-04-19T21:31:53Z", "severity": "MODERATE", "github_reviewed": true, "cwe_ids": [ "CWE-287", "CWE-863" ] }- References
Affected packages
Maven / com.atlassian.connect:atlassian-connect-spring-boot-starter
Package
- Name
- com.atlassian.connect:atlassian-connect-spring-boot-starter
- View open source insights on deps.dev
- Purl
- pkg:maven/com.atlassian.connect/atlassian-connect-spring-boot-starter