Cross-site Request Forgery (CSRF)

2018-03-0702:49:47

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

31.7%

JSON

auth0-js is vulnerable to cross-site request forgery (CSRF) attacks. These attacks are possible if the state parameter is missing in an authorization response.

CPENameOperatorVersion
auth0-jsle9.2.3
auth0-jsle8.6.1
auth0.jsle9.2.3
auth0-jseq8.4.0
auth0.jsle9.2.3
auth0.jsle8.6.1

Name	Operator	Version
auth0-js	le	9.2.3
auth0-js	le	8.6.1
auth0.js	le	9.2.3
auth0-js	eq	8.4.0
auth0.js	le	9.2.3
auth0.js	le	8.6.1

References

auth0.com/docs/security/bulletins/cve-2018-7307

github.com/auth0/auth0.js/pull/667

0.001 Low

EPSS

Percentile

31.7%

JSON

Related for VERACODE:5891