What is CVE-2018-15121?

CVE-2018-15121 is a high-severity vulnerability in Auth0 Aspnet, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2018-08-29.

How severe is CVE-2018-15121?

High severity. CVSS v3 base score is 8.8 out of 10.

CSRF in Auth0 Aspnet

CVE-2018-15121

An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations.

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.005 (39.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Auth0 Aspnet
Auth0 Aspnet-owin
N/a — versions n/a

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2018-15121?: CVE-2018-15121 is a high-severity vulnerability in Auth0 Aspnet, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2018-08-29.
How severe is CVE-2018-15121?: High severity. CVSS v3 base score is 8.8 out of 10.