by Kastro
Paper/Archive/CVE-2021-29451

CVE-2021-29451

ManyDesigns Portofino — Missing validation of JWT signature in `ManyDesigns/Portofino`

EPSS 0.9%CVSS 9.1
critical.is priorityof 100
40
CVSS 9.1 (CNA, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 61.2.612 × 2012.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Portofino is an open source web development framework. Portofino before version 5.2.1 did not properly verify the signature of JSON Web Tokens. This allows forging a valid JWT. The issue will be patched in the upcoming 5.2.1 release.

Affected

ProductAffectedFixed inSource
Portofino>= 5.0.0, < 5.2.1–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

refgithub.com/ManyDesigns/Portofino/security/advisories/GHSA-6g3c-2mh5-7q6xrefgithub.com/ManyDesigns/Portofino/commit/8c754a0ad234555e813dcbf9e57d637f9f23d8fbrefmvnrepository.com/artifact/com.manydesigns/portofino