auth0-js Privilege Escalation Vulnerability

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2017-17068 · ADVISORY
• appcheck-ng.com/appcheck-discovers-vulnerability-auth0-library-cve-2017-17068 · WEB
• auth0.com/docs/security/bulletins/cve-2017-17068 · WEB
• GitHub Advisory GHSA-3rpr-mg43-xhq4 · ADVISORY
• appcheck-ng.com/appcheck-discovers-vulnerability-auth0-library-cve-2017-17068 · Exploit

auth0.js のその他の脆弱性

• CVE-2026-42280高 7.1Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly…
• CVE-2020-15125高 7.7In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the…
• CVE-2020-5263中 4.9auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an (authentication)…
• CVE-2018-6874高 8.8CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.
• CVE-2018-6873緊急 9.8The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated.