Information disclosure in Auth0 Auth0.js
CVE-2020-15125
In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer token. You are affected by this vulnerability if you are using the auth0 npm package, and you are using a Machine to Machine application authorized to use Auth0's management API
EPSS: 0.015 (72.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.
Affected products
- Auth0 Auth0.js
- Auth0 Node-auth0 — versions < 2.27.1
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Third Party Advisory, x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2020-15125?
- CVE-2020-15125 is a high-severity vulnerability in Auth0 Auth0.js, classified under Generation of Error Message Containing Sensitive Information. CVSS score: 7.7/10. Published 2020-07-29.
- How severe is CVE-2020-15125?
- High severity. CVSS v3 base score is 7.7 out of 10.