CVE-2021-21403 Authentication Bypass by Primary Weakness in github.com/kongchuanhujiao/server
An authentication bypass vulnerability allows attackers to access the server without valid credentials, requiring an upgrade to the latest version.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-21403?
CVE-2021-21403 is a high-severity authentication bypass vulnerability in kongchuanhujiao server, published on 26 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In github.com/kongchuanhujiao/server before version 1.3.21 there is an authentication Bypass by Primary Weakness vulnerability. All users are impacted. This is fixed in version 1.3.21.
Which versions are affected by CVE-2021-21403?
2 open source packages ship an affected version, including github.com/kongchuanhujiao/server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/kongchuanhujiao/server Go | All versions | 1.3.21 |
github.com/kongchuanhujiao/server Go | All versions | 1.3.21 |
Products include Kongchuanhujiao Project Kongchuanhujiao.
How do I fix CVE-2021-21403?
Upgrade github.com/kongchuanhujiao/server to 1.3.21 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-21403 being exploited?
There is no known exploitation of CVE-2021-21403 in the wild and no public exploit code.
Sources
Also known as GHSA-8wrg-m8vm-5fvj.