Description

The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter.

Remediation

References

https://auth0.com/docs/security/bulletins/cve-2018-7307

Related Vulnerabilities

CVE-2018-11770 Vulnerability in maven package org.apache.spark:spark-core

CVE-2015-5209 Vulnerability in maven package org.apache.struts.xwork:xwork-core

CVE-2019-10414 Vulnerability in maven package de.wellnerbou.jenkins:git-changelog

CVE-2023-25813 Vulnerability in npm package sequelize

CVE-2018-3821 Vulnerability in npm package kibana

Severity

Critical

Classification

CWE-352 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Vendor Advisory