@cimpress/simple-auth-wrapper (>=3.0.0, <=6.4.6), @p2/core (>=1.2.0-alpha.0, <=1.2.0) +7 more potentially affected by CVE-2018-7307 via auth0-js (>=9.0.0, <=9.2.2)

auth0-js NPM version =9.0.0, =3.0.0, =1.2.0-alpha.0, =1.2.0-alpha.0, =1.2.0-alpha.0, =1.3.47, =11.0.0-beta.2, =1.3.0, =1.3.2 - olymp-auth 20.1.42 Source cves: CVE-2018-7307 Source advisory: OSV:GHSA-WPQ7-Q8J4-72JG...

CVE-2018-7307

Auth0.js (Auth0.js library) is affected up to and including version 9.3, where CSRF can occur if the authorization response lacks the state parameter. Root cause: improper handling of missing state in the response. Impact: CSRF vulnerability with high CVSS3 score (8.8) and notable risks of unauth...

CVE-2018-7307

The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter...