Intrusion PreventionApache.Pulsar.JSON.Web.Token.Authentication.Bypass
Description
This indicates an attack attempt to exploit an Authentication Bypass Vulnerability in Apache Software Foundation Pulsar.
The vulnerability is due to improper handling of unsigned JSON Web Tokens. An unauthenticated, remote attacker can exploit this vulnerability by sending a request with an unsigned JSON Web Token to a target server with JWT authentication enabled. Successful exploitation results in the attacker bypassing authentication and gaining the ability to interact with the affected service, potentially with administrative privileges.
Affected Products
Apache Software Foundation Pulsar prior to 2.7.1
Impact
Privilege Escalation: Remote attackers can leverage their privileges on vulnerable systems.
Recommended Actions
Apply the most recent upgrade or patch from the vendor.
http://mail-archives.apache.org/mod_mbox/pulsar-users/202105.mbox/%3CCAJVHGGyGbp9XSEp_3UscS%2BgLChBABEq0gotJFEK-sfbjG1Zdxg%40mail.gmail.com%3E
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
| ID | 50469 |
| Created | Jun 07, 2021 |
| Updated | Nov 17, 2021 |
| Risk |
|
| CVE ID | CVE-2021-22160 |
| Exploit Prediction Score | 1.68% |
| Default Action | drop |
| Active | |
| Affected OS | Linux |
| Affected App | Apache |