Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXByZnEtZjY2Zy00M21w

Information disclosure through error object in auth0.js

Overview

Between versions 8.0.0 and 9.13.1(inclusive), in the case of an (authentication) error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered.

If the error object is exposed or logged without modification, the application risks password exposure.

Am I affected?

You are affected by this vulnerability if all of the following conditions apply:

How to fix that?

Developers should upgrade auth0.js to version 9.13.2 or later where user inputted passwords are masked in errors. If upgrading is not possible, a temporary fix may include not storing the error object or displaying it publicly without modification.

Will this update impact my users?

This fix patches the Auth0.js and may require changes in application code due to password no longer available in error object, but it will not impact your users, their current state, or any existing sessions.

Permalink: https://github.com/advisories/GHSA-prfq-f66g-43mp
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXByZnEtZjY2Zy00M21w
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 5 years ago
Updated: about 2 years ago


CVSS Score: 5.5
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N

EPSS Percentage: 0.00063
EPSS Percentile: 0.2952

Identifiers: GHSA-prfq-f66g-43mp, CVE-2020-5263
References: Repository: https://github.com/auth0/auth0.js
Blast Radius: 23.0

Affected Packages

npm:auth0-js
Dependent packages: 286
Dependent repositories: 15,041
Downloads: 622,368 last month
Affected Version Ranges: >= 8.0.0, < 9.13.2
Fixed in: 9.13.2
All affected versions: 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.6.1, 8.7.0, 8.8.0, 8.9.0, 8.9.1, 8.9.2, 8.9.3, 8.10.0, 8.10.1, 8.11.0, 8.11.1, 8.11.2, 8.11.3, 8.12.0, 8.12.1, 8.12.2, 8.12.3, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.3.0, 9.3.1, 9.3.2, 9.3.3, 9.3.4, 9.4.0, 9.4.1, 9.4.2, 9.5.0, 9.5.1, 9.6.0, 9.6.1, 9.7.0, 9.7.1, 9.7.2, 9.7.3, 9.8.0, 9.8.1, 9.8.2, 9.9.0, 9.9.1, 9.10.0, 9.10.1, 9.10.2, 9.10.3, 9.10.4, 9.11.0, 9.11.1, 9.11.2, 9.11.3, 9.12.0, 9.12.1, 9.12.2, 9.13.0, 9.13.1
All unaffected versions: 0.1.5, 0.1.6, 0.1.7, 0.1.8, 0.2.0, 0.2.1, 0.2.2, 1.0.0, 1.1.0, 1.1.1, 1.2.0, 1.2.2, 1.3.0, 1.3.1, 1.3.3, 1.3.4, 1.3.5, 1.3.6, 1.3.7, 1.3.8, 1.3.10, 1.3.12, 1.4.3, 1.5.2, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.6.5, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.17, 2.0.18, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9, 2.1.10, 2.3.0, 3.0.0, 3.0.1, 3.0.3, 3.1.0, 3.2.1, 3.2.2, 3.2.3, 4.0.0, 4.0.1, 4.1.0, 4.2.0, 4.2.4, 4.2.5, 4.2.6, 4.2.7, 4.2.8, 4.2.9, 4.2.10, 4.2.11, 4.3.0, 5.0.0, 5.0.1, 5.1.0, 5.1.1, 5.2.0, 5.2.1, 5.2.2, 5.3.0, 5.4.0, 5.5.0, 5.5.1, 6.0.2, 6.0.4, 6.0.5, 6.0.6, 6.1.0, 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.4.1, 6.4.2, 6.5.0, 6.5.1, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.7.0, 6.7.1, 6.7.2, 6.7.3, 6.7.4, 6.7.5, 6.7.6, 6.7.7, 6.8.0, 6.8.1, 6.8.2, 6.8.3, 6.8.4, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.1.0, 7.2.0, 7.2.1, 7.3.0, 7.4.0, 7.5.0, 7.6.0, 7.6.1, 9.13.2, 9.13.3, 9.13.4, 9.14.0, 9.14.1, 9.14.2, 9.14.3, 9.15.0, 9.16.0, 9.16.1, 9.16.2, 9.16.3, 9.16.4, 9.17.0, 9.18.0, 9.18.1, 9.19.0, 9.19.1, 9.19.2, 9.20.0, 9.20.1, 9.20.2, 9.21.0, 9.22.0, 9.22.1, 9.23.0, 9.23.1, 9.23.2, 9.23.3, 9.24.0, 9.24.1, 9.25.0, 9.26.0, 9.26.1, 9.27.0, 9.28.0