CVE-2021-29455 : Grassroot Platform is an application to make it faster, cheaper and easier to pe

Grassroot Platform is an application to make it faster, cheaper and easier to persistently organize and mobilize people in low-income communities. Grassroot Platform before master deployment as of 2021-04-16 did not properly verify the signature of JSON Web Tokens when refreshing an existing JWT. This allows to forge a valid JWT. The problem has been patched in version 1.3.1 by deprecating the JWT refresh function, which was an overdue deprecation regardless (the "refresh" flow is no longer used).

Published 2021-04-19 19:15:18

Updated 2021-04-28 13:50:00

Source GitHub, Inc.

View at NVD, CVE.org

Products affected by CVE-2021-29455

Grassroot » Grassroot Platform
Versions before (<) 1.3.1
cpe:2.3:a:grassroot:grassroot_platform:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-29455

EPSS FAQ

0.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 36 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-29455

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	GitHub, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2021-29455

CWE-347 Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Assigned by: security-advisories@github.com (Primary)

References for CVE-2021-29455

https://github.com/grassrootza/grassroot-platform/commit/a2e6e885f8183a066d938cf909fd813a7af7d67f

Merge pull request #412 from grassrootza/fix/refresh · grassrootza/grassroot-platform@a2e6e88 · GitHub
Patch;Third Party Advisory
https://github.com/grassrootza/grassroot-platform/

GitHub - grassrootza/grassroot-platform: Modular application to make it easier and faster to organize and mobilize people, through a meeting organizer, vote taker, action logger and group manager.
Product;Third Party Advisory
https://github.com/grassrootza/grassroot-platform/security/advisories/GHSA-f65w-6xw8-6734

Missing validation of JWT signature in `grassrootza/grassroot-platform` · Advisory · grassrootza/grassroot-platform · GitHub
Third Party Advisory

Jump to

Vulnerability Details : CVE-2021-29455

Products affected by CVE-2021-29455

Exploit prediction scoring system (EPSS) score for CVE-2021-29455

CVSS scores for CVE-2021-29455

CWE ids for CVE-2021-29455

References for CVE-2021-29455