Missing validation of JWT signature in `ManyDesigns/Portofino`

2021-04-1914:56:33

Google

osv.dev

9.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

49.1%

JSON

Impact

Portofino is an open source web development framework. Portofino before version 5.2.1 did not properly verify the signature of JSON Web Tokens.
This allows forging a valid JWT.

Patches

The issue will be patched in the upcoming 5.2.1 release.

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/ManyDesigns/Portofino

CPENameOperatorVersion
com.manydesigns:portofino-dispatchereq5.2.0
com.manydesigns:portofino-dispatchereq5.1.0
com.manydesigns:portofino-dispatchereq5.0.3
com.manydesigns:portofino-coreeq5.0.1
com.manydesigns:portofino-dispatchereq5.1.1
com.manydesigns:portofino-dispatchereq5.1.2
com.manydesigns:portofino-coreeq5.1.3
com.manydesigns:portofino-coreeq5.1.4
com.manydesigns:portofino-coreeq5.1.1
com.manydesigns:portofino-dispatchereq5.0.0

Name	Operator	Version
com.manydesigns:portofino-dispatcher	eq	5.2.0
com.manydesigns:portofino-dispatcher	eq	5.1.0
com.manydesigns:portofino-dispatcher	eq	5.0.3
com.manydesigns:portofino-core	eq	5.0.1
com.manydesigns:portofino-dispatcher	eq	5.1.1
com.manydesigns:portofino-dispatcher	eq	5.1.2
com.manydesigns:portofino-core	eq	5.1.3
com.manydesigns:portofino-core	eq	5.1.4
com.manydesigns:portofino-core	eq	5.1.1
com.manydesigns:portofino-dispatcher	eq	5.0.0