high7.5
CVE-2021-27306
An improper access control vulnerability in the JWT plugin in Kong Gateway prior to 2.3.2.0 allows unauthenticated users access to authenticated routes without…
Impact
An improper access control vulnerability in the JWT plugin in Kong Gateway prior to 2.3.2.0 allows unauthenticated users access to authenticated routes without a valid token JWT.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Konghq | Kong Gateway | before 2.3.2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://docs.konghq.com/enterprise/changelog/#core-1
- https://medium.com/%40sew.campos/cve-2021-27306-access-an-authenticated-route-on-kong-api-gateway-6ae3d81968a3
- https://docs.konghq.com/enterprise/changelog/#core-1
- https://medium.com/%40sew.campos/cve-2021-27306-access-an-authenticated-route-on-kong-api-gateway-6ae3d81968a3