Information disclosure in Auth0 Auth0.js
CVE-2020-15125
In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer token. You are affected by this vulnerability if you are using the auth0 npm package, and you are using a Machine to Machine application authorized to use Auth0's management API
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.015 (73.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 74th percentile — 73.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: 0.000
Affected products
- Auth0 Auth0.js
- Auth0 Node-Auth0 — versions < 2.27.1
Weakness classification (CWE)
References
- github.com/auth0/node-auth0/security/advisories/GHSA-5jpf-pj32-xx53 (Third Party Advisory)
- github.com/auth0/node-auth0/pull/507 (Patch, Third Party Advisory)
- github.com/auth0/node-auth0/pull/507/commits/62ca61b3348ec8e74d7d00358661af1a8b… (Patch, Third Party Advisory)
- github.com/auth0/node-auth0/tree/v2.27.1 (Third Party Advisory, Release Notes)
Frequently asked questions
- What is CVE-2020-15125?
- CVE-2020-15125 is a high-severity vulnerability in Auth0 Auth0.js, classified under Generation of Error Message Containing Sensitive Information. CVSS score: 7.7/10. Published 2020-07-29.
- How severe is CVE-2020-15125?
- High severity. CVSS v3 base score is 7.7 out of 10.