{"id":"CVE-2021-45389","aliases":["EUVD-2021-32162","GHSA-34rp-625w-j33p"],"status":"published","title":"StarWind SAN \u0026 NAS build 1578 and StarWind Command Center Build 6864 Update Manager allows...","description":"A flaw was found with the JWT token. A self-signed JWT token could be injected into the update manager and bypass the authentication process, thus could escalate privileges. This affects StarWind SAN and NAS build 1578 and StarWind Command Center build 6864.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01205,"percentile":0.68501,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269","CWE-287"],"published":"2022-01-04T15:40:34Z","modified":"2026-06-17T04:13:19Z","products":[{"vendor":"starwind","product":"command_center"},{"vendor":"starwind","product":"san\\\u0026nas"}],"references":[{"url":"https://www.starwindsoftware.com/security/sw-20211512-0001/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://www.starwindsoftware.com/security/sw-20211215-0001/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45389"},{"url":"https://github.com/advisories/GHSA-34rp-625w-j33p"}],"sources":{"cve":[{"id":"CVE-2021-45389","description":"A flaw was found with the JWT token. A self-signed JWT token could be injected into the update manager and bypass the authentication process, thus could escalate privileges. This affects StarWind SAN and NAS build 1578 and StarWind Command Center build 6864.","status":"published","published":"2022-01-04T15:40:34Z","modified":"2024-08-04T04:39:20.701Z","updated_at":"2026-11-02T14:33:02.580561Z"}],"euvd":[{"id":"EUVD-2021-32162","description":"A flaw was found with the JWT token. A self-signed JWT token could be injected into the update manager and bypass the authentication process, thus could escalate privileges. This affects StarWind SAN and NAS build 1578 and StarWind Command Center build 6864.","status":"published","published":"2022-01-04T15:40:34Z","modified":"2024-08-04T04:39:20Z","updated_at":"2026-11-03T03:08:27.448176Z"}],"ghsa":[{"id":"GHSA-34rp-625w-j33p","title":"StarWind SAN \u0026 NAS build 1578 and StarWind Command Center Build 6864 Update Manager allows...","description":"StarWind SAN \u0026 NAS build 1578 and StarWind Command Center Build 6864 Update Manager allows authentication with JTW token which is signed with any key. An attacker could use self-signed JTW token to bypass authentication resulting in escalation of privileges.","status":"published","published":"2022-01-05T00:00:58Z","modified":"2023-01-29T05:03:59Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-269","CWE-287"],"updated_at":"2026-11-02T14:45:26.555782Z"}],"nvd":[{"id":"CVE-2021-45389","description":"A flaw was found with the JWT token. A self-signed JWT token could be injected into the update manager and bypass the authentication process, thus could escalate privileges. This affects StarWind SAN and NAS build 1578 and StarWind Command Center build 6864.","status":"published","published":"2022-01-04T16:15:09.727Z","modified":"2026-06-17T04:13:19.657Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:07:03.418194Z"}]}}