Description

The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated.

Remediation

References

http://www.securityfocus.com/bid/103695

https://auth0.com/docs/security/bulletins/cve-2018-6873

Related Vulnerabilities

CVE-2017-16023 Vulnerability in npm package decamelize

CVE-2020-35490 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind

CVE-2020-35149 Vulnerability in maven package org.webjars.npm:mquery

CVE-2021-23463 Vulnerability in maven package com.h2database:h2

CVE-2020-5259 Vulnerability in npm package dojox

Severity

Critical

Classification

CWE-287 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory VDB Entry Vendor Advisory