PT-2021-18224
CVE-2021-29451
·
Published
2021-04-16
·
Updated
2021-04-22
Description by
CVSS 3.1
9.1
CriticalMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions:
Portofino versions prior to 5.2.1
Description:
The issue is related to the improper verification of the signature of JSON Web Tokens, allowing for the forging of a valid JWT.
Recommendations:
For versions prior to 5.2.1, update to version 5.2.1 once it is released to resolve the issue. As a temporary workaround, consider implementing additional validation for JSON Web Tokens to minimize the risk of exploitation.
Found an issue in the description? Have something to add? Feel free to write us 👾