CVE-2021-32753

{"id": "CVE-2021-32753", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2021-07-09T19:15:08.373", "references": [{"url": "https://docs.konghq.com/hub/kong-inc/oauth2/#create-a-consumer", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/edgexfoundry/edgex-go/security/advisories/GHSA-xph4-vmcc-52gh", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://docs.konghq.com/hub/kong-inc/oauth2/#create-a-consumer", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/edgexfoundry/edgex-go/security/advisories/GHSA-xph4-vmcc-52gh", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-521"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-521"}]}], "descriptions": [{"lang": "en", "value": "EdgeX Foundry is an open source project for building a common open framework for internet-of-things edge computing. A vulnerability exists in the Edinburgh, Fuji, Geneva, and Hanoi versions of the software. When the EdgeX API gateway is configured for OAuth2 authentication and a proxy user is created, the client_id and client_secret required to obtain an OAuth2 authentication token are set to the username of the proxy user. A remote network attacker can then perform a dictionary-based password attack on the OAuth2 token endpoint of the API gateway to obtain an OAuth2 authentication token and use that token to make authenticated calls to EdgeX microservices from an untrusted network. OAuth2 is the default authentication method in EdgeX Edinburgh release. The default authentication method was changed to JWT in Fuji and later releases. Users should upgrade to the EdgeX Ireland release to obtain the fix. The OAuth2 authentication method is disabled in Ireland release. If unable to upgrade and OAuth2 authentication is required, users should create OAuth2 users directly using the Kong admin API and forgo the use of the `security-proxy-setup` tool to create OAuth2 users."}, {"lang": "es", "value": "EdgeX Foundry es un proyecto de c\u00f3digo abierto para construir un framework abierto com\u00fan para la computaci\u00f3n de borde de la Internet de las cosas. Se presenta una vulnerabilidad en las versiones Edimburgo, Fuji, Ginebra y Hanoi del software. Cuando la puerta de enlace de la API EdgeX est\u00e1 configurada para la autenticaci\u00f3n OAuth2 y es creado un usuario proxy, el client_id y el client_secret requeridos para obtener un token de autenticaci\u00f3n OAuth2 se ajustan con el nombre de usuario del usuario proxy. Un atacante remoto de la red puede entonces llevar a cabo un ataque de contrase\u00f1a basado en diccionario en el endpoint del token OAuth2 de la puerta de enlace de la API para obtener un token de autenticaci\u00f3n OAuth2 y usar ese token para hacer llamadas autenticadas a los microservicios de EdgeX desde una red no confiable. OAuth2 es el m\u00e9todo de autenticaci\u00f3n predeterminado en la versi\u00f3n de EdgeX Edinburgh. El m\u00e9todo de autenticaci\u00f3n predeterminado fue cambiado a JWT en Fuji y versiones posteriores. Los usuarios deben actualizar a versi\u00f3n de EdgeX Ireland para obtener la correcci\u00f3n. El m\u00e9todo de autenticaci\u00f3n OAuth2 est\u00e1 deshabilitado en la versi\u00f3n Ireland. Si no se puede actualizar y es requerida la autenticaci\u00f3n OAuth2, los usuarios deben crear usuarios OAuth2 directamente usando la API de Kong admin y renunciar al uso de la herramienta \"security-proxy-setup\" para crear usuarios OAuth2"}], "lastModified": "2024-11-21T06:07:40.413", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:edgexfoundry:edgex_foundry:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "75F38141-9394-4C6F-9958-755DF1FE496A", "versionEndExcluding": "2.0.0", "versionStartIncluding": "1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}