Description

The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated.

Remediation

References

http://www.securityfocus.com/bid/103695

https://auth0.com/docs/security/bulletins/cve-2018-6873

Related Vulnerabilities

CVE-2020-28501 Vulnerability in npm package es6-crawler-detect

CVE-2022-31089 Vulnerability in npm package parse-server

CVE-2020-13929 Vulnerability in maven package org.apache.zeppelin:zeppelin

CVE-2018-14719 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind

CVE-2018-3758 Vulnerability in npm package express-cart

Severity

Critical

Classification

CWE-287 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory VDB Entry Vendor Advisory