PT-2021-18255 · Unknown · Bubble Fireworks

Published 2021-06-04 · Updated 2021-06-15 · CVE-2021-29500

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: bubble fireworks versions prior to 2021.BUILD-SNAPSHOT

Description: The issue concerns a vulnerability in the package where it did not properly verify the signature of JSON Web Tokens, allowing for the forgery of valid JWTs. This affects the bubble fireworks package, which is related to the Spring Framework.

Recommendations: For versions prior to 2021.BUILD-SNAPSHOT, update to version 2021.BUILD-SNAPSHOT or later to resolve the issue. As a temporary workaround, consider implementing additional signature verification for JSON Web Tokens until the update can be applied.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2021-29500

GHSA-HJ36-84CP-29PR

Affected Products

Bubble Fireworks

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-29500 · Security Note
• https://osv.dev/vulnerability/CVE-2021-29500 · Vendor Advisory
• https://github.com/fxbin/bubble-fireworks/security/advisories/GHSA-hj36-84cp-29pr · Note
• https://t.me/cvenotify/16330 · Telegram Post
• https://t.me/cvenotify/15608 · Telegram Post