CVE-2021-4314
Published: 18 January 2023
Summary
CVE-2021-4314 is a medium-severity Improper Privilege Management (CWE-269) vulnerability in Linuxfoundation Zowe Api Mediation Layer. Its CVSS base score is 5.3 (Medium).
Operationally, ranked at the 43.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Machine Learning Libraries.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-34144
Vulnerability details
It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only in the situation when zOSMF doesn’t have the APAR PH12143 applied. This…
more
issue affects: 1.16 versions to 1.19. What happens is that the services using the ZAAS client or the API ML API to query will be deceived into believing the information in the JWT token is valid when it isn’t. It’s possible to use this to persuade the southbound service that different user is authenticated.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Machine Learning Libraries
- Risk Domain
- N/A
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: ml
Related Threats
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Documented procedures ensure personnel are trained on authentication mechanisms, tangibly lowering the risk of improper authentication being exploited.
Training covers proper privilege management practices, making incorrect privilege assignments less likely.
Review helps detect improper privilege management by flagging unauthorized privilege changes or uses.
System recovery re-establishes trusted authentication processes following a compromise.
Centralized privilege assignment and oversight prevent ad-hoc or excessive privilege grants that occur when each system is configured independently.
Security-conscious enterprise architecture mandates authentication mechanisms and identity management at scale, mitigating improper authentication.
Documented procedures for role definition, privilege assignment, and removal provide the management framework that prevents improper privilege management.
Revoking authenticators and credentials eliminates the ability of terminated individuals to authenticate using prior mechanisms.