HIGH🇬🇧 English

CVE-2018-7307

CVSS 8.8v3.0pub. 2018-03-06upd. 2024-11-21

The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter.

oryginał EN
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

  • Auth0 Auth0.js

    APP
    Auth0
    < 9.3
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2018-6873CRITICAL9.8ten sam produkt

The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not...

CVE-2026-42280HIGH7.1ten sam produkt

Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, t...

CVE-2020-15125HIGH7.7ten sam produkt

In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the r...

CVE-2018-6874HIGH8.8ten sam produkt

CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.

CVE-2017-17068HIGH7.5ten sam produkt

A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This...