Security Advisory

CVE-2021-29455

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2021-04-19 19:05:15

Last updated 2024-08-03 22:02:51

Assigner GitHub_M

State PUBLISHED

Description

Grassroot Platform is an application to make it faster, cheaper and easier to persistently organize and mobilize people in low-income communities. Grassroot Platform before master deployment as of 2021-04-16 did not properly verify the signature of JSON Web Tokens when refreshing an existing JWT. This allows to forge a valid JWT. The problem has been patched in version 1.3.1 by deprecating the JWT refresh function, which was an overdue deprecation regardless (the "refresh" flow is no longer used).

← Browse all CVEs View on cve.org ↗