CVE-2020-15119 – auth0-lock

Package

Manager: npm
Name: auth0-lock
Vulnerable Version: >=0 <=11.25.1

Severity

Level: Low

CVSS v3.1: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS: 0.00282 pctl0.51207

Details

DOM-based XSS in auth0-lock ### Overview Versions before and including `11.25.1` are using `dangerouslySetInnerHTML` to display an informational message when used with a Passwordless or Enterprise connection. - For Passwordless connection, the value of the input (email or phone number) is displayed back to the user while waiting for verification code input. - For Enterprise connection, the value of the input (IdP Domain) from the Enterprise connection setup screen (Auth0 Dashboard) is displayed back to the user when the `lock` widget opens. When Passwordless or Enterprise connection is used, the application and its users might be exposed to cross-site scripting (XSS) attacks. ### Am I affected? You are affected by this vulnerability if all of the following conditions apply: - You are using auth0-lock - You are using Passwordless or Enterprise connection mode ### How to fix that? Upgrade to version `11.26.3` ### Will this update impact my users? The fix provided in patch will not affect your users. ### Credit https://github.com/mvisat

Metadata

Created: 2020-08-19T21:05:03Z
Modified: 2021-01-07T23:40:43Z
Source: MANUAL
CWE IDs: ["CWE-79"]
Alternative ID: GHSA-6gg3-pmm7-97xc
Finding: F008
Auto approve: 1