要点
- CVE-2020-15125 は auth0.js (auth0), auth0 に影響する深刻度「高」 (CVSS 7.7) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：1.5%（全脆弱性の 74.9% より高い）。
- 対処：2.27.1 以降に更新してください。
| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|
| auth0.js | < 2.27.1
| 2.27.1
|
| auth0 npm | < 2.27.1
| 2.27.1
|
概要
Overview
Versions before and including 2.27.0 use a block list of specific keys that should be sanitized from the request object contained in the error object. When a request to Auth0 management API fails, the key for Authorization header is not sanitized and the Authorization header value can be logged exposing a bearer token.
Am I affected?
You are affected by this vulnerability if all of the following conditions apply:
How to fix that?
Upgrade to version 2.27.1
Will this update impact my users?
The fix provided in patch will not affect your users.
Credit
http://github.com/osdiab
NVD の説明
In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer token. You are affected by this vulnerability if you are using the auth0 npm package, and you are using a Machine to Machine application authorized to use Auth0's management API
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン