Gravitee Api Management
Approved changes feed: RSS · Atom
cpe:2.3:a:gravitee:gravitee_api_management:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Gravitee (b0b56a95-2ad2-51df-82fc-4f366863691e) |
|---|---|
| Product | Gravitee Api Management (99c13182-e238-50aa-bfb7-2c37a9077128) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2020-37281 |
vulnerable | 2026-11-03 10:49:48.331164 |
Gravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass
HIGH (8.1)
Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject and present it as a bearer token to the Management API, impersonating administrators to gain full platform control.
Published: 2026-10-14T14:16:28.167Z
Updated: 2026-10-27T01:30:25.397Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.