CVE-2018-6873: Critical severity Auth0 auth0.js vulnerability
Published Apr 4, 2018
·Updated
The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated.
Affected Software
1 affected component
Auth0 auth0.js<=8.10.1
Event History
Apr 4, 2018
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Data Sourced
via NVD·05:29 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2018-6873?
CVE-2018-6873 has a medium severity rating due to its risk of privilege escalation.
2
How do I fix CVE-2018-6873?
To fix CVE-2018-6873, upgrade Auth0.js to version 8.10.2 or later.
3
What causes the vulnerability in CVE-2018-6873?
The vulnerability in CVE-2018-6873 is caused by the lack of validation on the JWT audience in the Auth0 authentication service.
4
Which versions of Auth0.js are affected by CVE-2018-6873?
Auth0.js versions up to and including 8.10.1 are affected by CVE-2018-6873.
5
What is the impact of CVE-2018-6873 on applications?
The impact of CVE-2018-6873 allows unauthorized users to potentially gain elevated privileges within an application.