Cyber Resilience

CVE-2021-4314

Medium

Published: 18 January 2023

Published
18 January 2023
Modified
03 April 2025
KEV Added
Patch
CVSS Score v3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS Score 0.0021 43.5th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-4314 is a medium-severity Improper Privilege Management (CWE-269) vulnerability in Linuxfoundation Zowe Api Mediation Layer. Its CVSS base score is 5.3 (Medium).

Operationally, ranked at the 43.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as Machine Learning Libraries.

EU & UK References

Vulnerability details

It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only in the situation when zOSMF doesn’t have the APAR PH12143 applied. This…

more

issue affects: 1.16 versions to 1.19. What happens is that the services using the ZAAS client or the API ML API to query will be deceived into believing the information in the JWT token is valid when it isn’t. It’s possible to use this to persuade the southbound service that different user is authenticated.

CWE(s)

AI Security AnalysisAI

AI Category
Machine Learning Libraries
Risk Domain
N/A
OWASP Top 10 for LLMs 2025
None mapped
Classification Reason
Matched keywords: ml

Related Threats

Affected Assets

linuxfoundation
zowe api mediation layer
1.16.0 — 1.19.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-287 CWE-269

Documented procedures ensure personnel are trained on authentication mechanisms, tangibly lowering the risk of improper authentication being exploited.

addresses: CWE-269 CWE-287

Training covers proper privilege management practices, making incorrect privilege assignments less likely.

addresses: CWE-269 CWE-287

Review helps detect improper privilege management by flagging unauthorized privilege changes or uses.

addresses: CWE-287 CWE-269

System recovery re-establishes trusted authentication processes following a compromise.

addresses: CWE-269 CWE-287

Centralized privilege assignment and oversight prevent ad-hoc or excessive privilege grants that occur when each system is configured independently.

addresses: CWE-287 CWE-269

Security-conscious enterprise architecture mandates authentication mechanisms and identity management at scale, mitigating improper authentication.

addresses: CWE-269 CWE-287

Documented procedures for role definition, privilege assignment, and removal provide the management framework that prevents improper privilege management.

addresses: CWE-287 CWE-269

Revoking authenticators and credentials eliminates the ability of terminated individuals to authenticate using prior mechanisms.

References