Vulnerability · Published Jun 4, 2021 · Assigned by GitHub_M
CVE-2021-29500Missing validation of JWT signature
High 7.5
In plain English
A high-severity security flaw in bubble-fireworks from fxbin. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 51.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
bubble fireworks is an open source java package relating to Spring Framework. In bubble fireworks before version 2021.BUILD-SNAPSHOT there is a vulnerability in which the package did not properly verify the signature of JSON Web Tokens. This allows to forgery of valid JWTs.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| fxbin | bubble-fireworks | < 2021.BUILD-SNAPSHOT |
Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N