CVE-2018-15121: CSRF
An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-15121?
CVE-2018-15121 is considered a medium severity vulnerability due to its potential for CSRF attacks during authentication.
How do I fix CVE-2018-15121?
To fix CVE-2018-15121, ensure that the affected Auth0 packages are updated to versions that validate the state parameter in OAuth 2.0 and OpenID Connect protocols.
What applications are affected by CVE-2018-15121?
CVE-2018-15121 affects the Auth0 auth0-aspnet and auth0-aspnet-owin packages.
What kind of attacks does CVE-2018-15121 expose applications to?
CVE-2018-15121 exposes applications to Cross-Site Request Forgery (CSRF) attacks during authentication and authorization.
Is authentication or authorization more affected by CVE-2018-15121?
Both authentication and authorization operations are affected by CVE-2018-15121 due to the improper validation of the state parameter.