CVE-2022-31127

🗓️ 06 Jul 2022 18:00:16Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 66 Views🌐 WEB

NextAuth.js CVE-2022-31127 email server phishing vulnerabilit

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2022-31127	6 Jul 202222:14	–	circl
CNNVD	ZEIT Next.js NextAuth.js 跨站脚本漏洞	6 Jul 202200:00	–	cnnvd
CNVD	ZEIT Next.js NextAuth.js Cross-Site Scripting Vulnerability	8 Jul 202200:00	–	cnvd
Cvelist	CVE-2022-31127 Improper handling of email input in next-auth	6 Jul 202218:00	–	cvelist
EUVD	EUVD-2022-6383	3 Oct 202520:07	–	euvd
Github Security Blog	Improper handling of email input	6 Jul 202219:27	–	github
NVD	CVE-2022-31127	6 Jul 202218:15	–	nvd
OSV	GHSA-PGJX-7F9G-9463 Improper handling of email input	6 Jul 202219:27	–	osv
Prion	Hardcoded credentials	6 Jul 202218:15	–	prion
RedhatCVE	CVE-2022-31127	5 Feb 202520:25	–	redhatcve

NVD

Vulners

Node

nextauth.js next-authRange<3.29.8node.js

nextauth.js next-authRange4.0.0–4.9.0node.js

[
  {
    "product": "next-auth",
    "vendor": "nextauthjs",
    "versions": [
      {
        "status": "affected",
        "version": "< 3.29.8"
      },
      {
        "status": "affected",
        "version": ">= 4.0.0, < 4.9.0"
      }
    ]
  }
]

Source	Link
github	www.github.com/nextauthjs/next-auth/security/advisories/GHSA-pgjx-7f9g-9463
next-auth	www.next-auth.js.org/providers/email
github	www.github.com/nextauthjs/next-auth/releases/tag/next-auth%40v4.9.0
github	www.github.com/nextauthjs/next-auth/commit/ae834f1e08a4a9915665eecb9479c74c6b039c9c
next-auth	www.next-auth.js.org/getting-started/upgrade-v4

Parameter	Position	Path	Description	CWE
email	request body	/api/auth/signin/provider	Potential XSS when an attacker supplies HTML in the email parameter that is rendered in an HTML email, enabling phishing via the signin flow.	CWE-79