Vulnerability · Published Apr 9, 2020 · Assigned by GitHub_M
CVE-2020-5263Information disclosure through error object
Medium 5.5
In plain English
A medium-severity security flaw in auth0.js from auth0. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an (authentication) error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the error object is exposed or logged without modification, the application risks password exposure. This is fixed in version 9.12.3
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | auth0-js | 9.13.2 | GHSA-prfq-f66g-43mp |
Affected products (as reported)
Weakness: CWE-522 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N