Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2021-22160

If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user (incl. admins).
Exploit prediction scoring system (EPSS) score
EPSS Score 0.185
EPSS Ranking 95.0%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 7.5
References
Products affected by CVE-2021-22160
  • Apache » Pulsar » Version: 1.14
    cpe:2.3:a:apache:pulsar:1.14
  • Apache » Pulsar » Version: 1.15
    cpe:2.3:a:apache:pulsar:1.15
  • Apache » Pulsar » Version: 1.15.1
    cpe:2.3:a:apache:pulsar:1.15.1
  • Apache » Pulsar » Version: 1.15.2
    cpe:2.3:a:apache:pulsar:1.15.2
  • Apache » Pulsar » Version: 1.15.3
    cpe:2.3:a:apache:pulsar:1.15.3
  • Apache » Pulsar » Version: 1.15.4
    cpe:2.3:a:apache:pulsar:1.15.4
  • Apache » Pulsar » Version: 1.15.5
    cpe:2.3:a:apache:pulsar:1.15.5
  • Apache » Pulsar » Version: 1.15.6
    cpe:2.3:a:apache:pulsar:1.15.6
  • Apache » Pulsar » Version: 1.15.7
    cpe:2.3:a:apache:pulsar:1.15.7
  • Apache » Pulsar » Version: 1.16
    cpe:2.3:a:apache:pulsar:1.16
  • Apache » Pulsar » Version: 1.16.1
    cpe:2.3:a:apache:pulsar:1.16.1
  • Apache » Pulsar » Version: 1.16.2
    cpe:2.3:a:apache:pulsar:1.16.2
  • Apache » Pulsar » Version: 1.16.3
    cpe:2.3:a:apache:pulsar:1.16.3
  • Apache » Pulsar » Version: 1.16.4
    cpe:2.3:a:apache:pulsar:1.16.4
  • Apache » Pulsar » Version: 1.16.5
    cpe:2.3:a:apache:pulsar:1.16.5
  • Apache » Pulsar » Version: 1.17
    cpe:2.3:a:apache:pulsar:1.17
  • Apache » Pulsar » Version: 1.17.1
    cpe:2.3:a:apache:pulsar:1.17.1
  • Apache » Pulsar » Version: 1.17.2
    cpe:2.3:a:apache:pulsar:1.17.2
  • Apache » Pulsar » Version: 1.17.3
    cpe:2.3:a:apache:pulsar:1.17.3
  • Apache » Pulsar » Version: 1.17.4
    cpe:2.3:a:apache:pulsar:1.17.4
  • Apache » Pulsar » Version: 1.17.5
    cpe:2.3:a:apache:pulsar:1.17.5
  • Apache » Pulsar » Version: 1.18
    cpe:2.3:a:apache:pulsar:1.18
  • Apache » Pulsar » Version: 1.19.0
    cpe:2.3:a:apache:pulsar:1.19.0
  • Apache » Pulsar » Version: 1.20.0
    cpe:2.3:a:apache:pulsar:1.20.0
  • Apache » Pulsar » Version: 1.21.0
    cpe:2.3:a:apache:pulsar:1.21.0
  • Apache » Pulsar » Version: 1.22.0
    cpe:2.3:a:apache:pulsar:1.22.0
  • Apache » Pulsar » Version: 1.22.1
    cpe:2.3:a:apache:pulsar:1.22.1
  • Apache » Pulsar » Version: 2.0.0
    cpe:2.3:a:apache:pulsar:2.0.0
  • Apache » Pulsar » Version: 2.0.1
    cpe:2.3:a:apache:pulsar:2.0.1
  • Apache » Pulsar » Version: 2.1.0
    cpe:2.3:a:apache:pulsar:2.1.0
  • Apache » Pulsar » Version: 2.1.1
    cpe:2.3:a:apache:pulsar:2.1.1
  • Apache » Pulsar » Version: 2.2.0
    cpe:2.3:a:apache:pulsar:2.2.0
  • Apache » Pulsar » Version: 2.2.1
    cpe:2.3:a:apache:pulsar:2.2.1
  • Apache » Pulsar » Version: 2.3.0
    cpe:2.3:a:apache:pulsar:2.3.0
  • Apache » Pulsar » Version: 2.3.1
    cpe:2.3:a:apache:pulsar:2.3.1
  • Apache » Pulsar » Version: 2.3.2
    cpe:2.3:a:apache:pulsar:2.3.2
  • Apache » Pulsar » Version: 2.4.0
    cpe:2.3:a:apache:pulsar:2.4.0
  • Apache » Pulsar » Version: 2.4.1
    cpe:2.3:a:apache:pulsar:2.4.1
  • Apache » Pulsar » Version: 2.4.2
    cpe:2.3:a:apache:pulsar:2.4.2
  • Apache » Pulsar » Version: 2.5.0
    cpe:2.3:a:apache:pulsar:2.5.0
  • Apache » Pulsar » Version: 2.5.1
    cpe:2.3:a:apache:pulsar:2.5.1
  • Apache » Pulsar » Version: 2.5.2
    cpe:2.3:a:apache:pulsar:2.5.2
  • Apache » Pulsar » Version: 2.6.0
    cpe:2.3:a:apache:pulsar:2.6.0
  • Apache » Pulsar » Version: 2.6.1
    cpe:2.3:a:apache:pulsar:2.6.1
  • Apache » Pulsar » Version: 2.6.2
    cpe:2.3:a:apache:pulsar:2.6.2
  • Apache » Pulsar » Version: 2.6.3
    cpe:2.3:a:apache:pulsar:2.6.3
  • Apache » Pulsar » Version: 2.6.4
    cpe:2.3:a:apache:pulsar:2.6.4
  • Apache » Pulsar » Version: 2.7.0
    cpe:2.3:a:apache:pulsar:2.7.0


Products
Pricing
Contact Us

Shodan ® - All rights reserved