Lucene search
Veracode Vulnerability DatabaseVERACODE:25992HistoryJul 30, 2020 - 3:10 a.m.
Information Disclosure
2020-07-3003:10:17
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
7
0.001 Low
EPSS
Percentile
39.7%
auth0 is vulnerable to information disclosure. When Auth0’s management API is used to a Machine to Machine application authorization, it does not sanitize DenyList of specific key in the Authorization header and logs Authorization header value, exposing a bearer tokens.
References
github.com/auth0/node-auth0/commit/e23cd867a317c26b2aa39bd7fbacd59acb243195
github.com/auth0/node-auth0/pull/507
github.com/auth0/node-auth0/pull/507/commits/62ca61b3348ec8e74d7d00358661af1a8bc98a3c
github.com/auth0/node-auth0/security/advisories/GHSA-5jpf-pj32-xx53
github.com/auth0/node-auth0/tree/v2.27.1
Related
cve
cve
CVE-2020-15125
2020-07-29 17:15:13
cvelist
cvelist
nvd
nvd
CVE-2020-15125
2020-07-29 17:15:13
github
github
Authorization header is not sanitized in an error object in auth0
2020-07-29 16:26:22
nodejs
nodejs
Information Exposure
2020-07-29 17:14:33
prion
prion
Authorization
2020-07-29 17:15:00
osv
osv
Authorization header is not sanitized in an error object in auth0
2020-07-29 16:26:22