CVE-2020-15125
High
Description
In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer token. You are affected by this vulnerability if you are using the auth0 npm package, and you are using a Machine to Machine application authorized to use Auth0's management API
SeverityHigh
CVSS7.7
Exploit probability—
Product
Auth0
PublishedJul 29, 2020
First seenJul 29, 2020
Weakness typeCWE-209CWE-209
How to fix
Update
- auth02.27.1 or later
- auth0 auth0.js2.27.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| auth0npm | v < 2.27.1 | 2.27.1 |
| auth0 auth0.js | v < 2.27.1 | 2.27.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.