auth0 Vulnerabilities and Affected Products
Vulnerabilities associated with lock.
Products
Clear product- nextjs-auth07 vulnerabilities
- auth0-PHP4 vulnerabilities
- lock3 vulnerabilities
- node-jsonwebtoken3 vulnerabilities
- passport-wsfed-saml23 vulnerabilities
- auth0.js2 vulnerabilities
- express-openid-connect2 vulnerabilities
- ad-ldap-connector1 vulnerability
- express-jwt1 vulnerability
- laravel-auth01 vulnerability
- Login by Auth01 vulnerability
- node-auth01 vulnerability
- node-jws1 vulnerability
- omniauth-auth01 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2022-29172MEDIUM | HTML injection with additional signup fieldsAuth0 is an authentication broker that supports both social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. In versions before `11.33.0`, when the “additional signup fields” feature [is configured](https://github.com/auth0/lock#additional-sign-up-fields), a malicious actor can inject invalidated HTML code into these additional fields, which is then stored in the service `user_metdata` payload (using the `name` property). Verification emails, when… CWE-79May 5, 2022 | CVSS6.1v3.1 | EPSS0.598% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-32641HIGH | Reflected XSS when using flashMessagesauth0-lock is Auth0's signin solution. Versions of nauth0-lock before and including `11.30.0` are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's `flashMessage` feature is utilized and user input or data from URL parameters is incorporated into the `flashMessage` or the library's `languageDictionary` feature is utilized and user input or data from URL parameters is incorporated into the `languageDictionary`. The vulnerability is patched in version 11.30.1. CWE-79Jun 4, 2021 | CVSS8.1v3.1 | EPSS1.54% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-15119MEDIUM | DOM-based XSS in auth0-lockIn auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting (XSS) attacks. CWE-79Aug 19, 2020 | CVSS6.4v3.1 | EPSS0.546% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |