CVE-2020-15119

MEDIUM

auth0-lock <= 11.25.1 - Cross-Site Scripting via dangerouslySetInnerHTML

Title source: llm
STIX 2.1

Description

In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting (XSS) attacks.

References (1)

Core 1
Core References

Scores

CVSS v3 6.4
EPSS 0.0055
EPSS Percentile 42.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Details

CWE
CWE-79
Status published
Products (2)
auth0/lock < 11.25.1
npm/auth0-lock 0 - 11.26.3npm
Published Aug 20, 2020
Tracked Since Feb 18, 2026