PT-2020-14200 · Auth0 · Auth0-Lock

Lzychowski + 1 · Published 2020-08-19 · Updated 2020-08-25 · CVE-2020-15119

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions auth0-lock versions prior to 11.26.3

Description The issue exposes applications and their users to cross-site scripting (XSS) attacks due to the use of dangerouslySetInnerHTML to update the DOM. This occurs when auth0-lock is used with Passwordless or Enterprise connection modes, where user input (such as email, phone number, or IdP Domain) is displayed back to the user. This can lead to XSS attacks.

Recommendations For versions prior to 11.26.3, upgrade to version 11.26.3 to resolve the issue. As a temporary workaround, consider avoiding the use of Passwordless or Enterprise connection modes until the upgrade is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-15119

GHSA-6GG3-PMM7-97XC

Affected Products

Auth0-Lock

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-15119 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15119 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6gg3-pmm7-97xc · Vendor Advisory
• https://github.com/auth0/lock/security/advisories/GHSA-6gg3-pmm7-97xc · Note
• https://github.com/auth0/lock/commit/3711fb5b42afd40073a61a58759251f51e768b1b · Note