CVE-2024-0981
High
Description
Okta Browser Plugin versions 6.5.0 through 6.31.0 (Chrome/Edge/Firefox/Safari) are vulnerable to cross-site scripting. This issue occurs when the plugin prompts the user to save these credentials within Okta Personal. A fix was implemented to properly escape these fields, addressing the vulnerability. Importantly, if Okta Personal is not added to the plugin to enable multi-account view, the Workforce Identity Cloud plugin is not affected by this issue. The vulnerability is fixed in Okta Browser Plugin version 6.32.0 for Chrome/Edge/Safari/Firefox.
SeverityHigh
CVSS7.1
Exploit probability—
Product
Okta Browser Plugin
PublishedJul 23, 2024
First seenJul 23, 2024
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Okta Okta Browser Plugin | 6.5.0 through 6.31.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.