Lucene search

GitHub_MCVE-2020-5263

HistoryApr 09, 2020 - 4:15 p.m.

CVE-2020-5263

2020-04-0916:15:12

CWE-522

GitHub_M

web.nvd.nist.gov

cve-2020-5263

npm package

auth0.js

vulnerability

authentication error

plaintext password

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N

AI Score

5.1

Confidence

High

EPSS

0.001

Percentile

27.0%

JSON

auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an (authentication) error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the error object is exposed or logged without modification, the application risks password exposure. This is fixed in version 9.12.3

Affected configurations

Nvd

Vulners

Node

auth0auth0.jsRange8.0.0–9.13.1

VendorProductVersionCPE
auth0auth0.js*cpe:2.3:a:auth0:auth0.js:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
auth0	auth0.js	*	cpe:2.3:a:auth0:auth0.js::::::::

CNA Affected

[
  {
    "product": "auth0.js",
    "vendor": "auth0",
    "versions": [
      {
        "status": "affected",
        "version": ">= 8.0.0, < 9.12.3"
      }
    ]
  }
]

References

github.com/auth0/auth0.js/commit/355ca749b229fb93142f0b3978399b248d710828

github.com/auth0/auth0.js/security/advisories/GHSA-prfq-f66g-43mp

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N

AI Score

5.1

Confidence

High

EPSS

0.001

Percentile

27.0%

JSON

Related for CVE-2020-5263