What is GHSA-6g3c-2mh5-7q6x?

GHSA-6g3c-2mh5-7q6x is a security advisory published by GitHub Security Advisories with Critical severity. Missing validation of JWT signature in `ManyDesigns/Portofino`

Which CVE IDs does GHSA-6g3c-2mh5-7q6x cover?

GHSA-6g3c-2mh5-7q6x covers the following CVE IDs: CVE-2021-29451. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6g3c-2mh5-7q6x?

GHSA-6g3c-2mh5-7q6x has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

Which products are affected by GHSA-6g3c-2mh5-7q6x?

GHSA-6g3c-2mh5-7q6x affects 2 products, including: maven/com.manydesigns:portofino-dispatcher:\u003e= 5.0.0, \u003c 5.2.1; maven/com.manydesigns:portofino-core:\u003e= 5.0.0, \u003c 5.2.1.

GHSA-6g3c-2mh5-7q6xCriticalCVSS 9.1

Missing validation of JWT signature in `ManyDesigns/Portofino`

Vendor

GitHub Security Advisories

Published

April 19, 2021

Last Modified

September 25, 2023

🔗 CVE IDs covered (1)

CVE-2021-29451 →

📋 Description

Impact

Portofino is an open source web development framework. Portofino before version 5.2.1 did not properly verify the signature of JSON Web Tokens. This allows forging a valid JWT.

Patches

The issue will be patched in the upcoming 5.2.1 release.

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/ManyDesigns/Portofino

🎯 Affected products2

maven/com.manydesigns:portofino-dispatcher:>= 5.0.0, < 5.2.1
maven/com.manydesigns:portofino-core:>= 5.0.0, < 5.2.1

🔗 References (5)

https://github.com/ManyDesigns/Portofino/security/advisories/GHSA-6g3c-2mh5-7q6x
https://github.com/ManyDesigns/Portofino/commit/8c754a0ad234555e813dcbf9e57d637f9f23d8fb
https://mvnrepository.com/artifact/com.manydesigns/portofino
https://nvd.nist.gov/vuln/detail/CVE-2021-29451
https://github.com/advisories/GHSA-6g3c-2mh5-7q6x