What is the severity of CVE-2018-6874?

CVE-2018-6874 is classified as a high severity vulnerability due to its impact on authentication processes.

How do I fix CVE-2018-6874?

To fix CVE-2018-6874, disable the Legacy Lock API flag in your Auth0 configuration.

What causes CVE-2018-6874?

CVE-2018-6874 is caused by a Cross-Site Request Forgery (CSRF) vulnerability resulting from a flaw in the Auth0 authentication service.

Which versions are affected by CVE-2018-6874?

CVE-2018-6874 affects Auth0.js versions up to and including 8.12.1 when the Legacy Lock API flag is enabled.

Is CVE-2018-6874 exploitable?

Yes, CVE-2018-6874 is exploitable if an attacker can induce a user to perform actions without their consent while authenticated.

Vulnerability/
CVE-2018-6874

high

8.8

CWE

352

4/4/2018

5/8/2024

CVE-2018-6874: CSRF

First published: Wed Apr 04 2018(Updated: )

CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.

Credit: cve@mitre.org

Affected Software	Affected Version	How to fix
Auth0 Auth0.js	<=8.12.1

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2018-6874?
CVE-2018-6874 is classified as a high severity vulnerability due to its impact on authentication processes.
How do I fix CVE-2018-6874?
To fix CVE-2018-6874, disable the Legacy Lock API flag in your Auth0 configuration.
What causes CVE-2018-6874?
CVE-2018-6874 is caused by a Cross-Site Request Forgery (CSRF) vulnerability resulting from a flaw in the Auth0 authentication service.
Which versions are affected by CVE-2018-6874?
CVE-2018-6874 affects Auth0.js versions up to and including 8.12.1 when the Legacy Lock API flag is enabled.
Is CVE-2018-6874 exploitable?
Yes, CVE-2018-6874 is exploitable if an attacker can induce a user to perform actions without their consent while authenticated.

collector/nvd-index
agent/references
agent/type
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/weakness
agent/severity
agent/author
agent/description
agent/first-publish-date
agent/event
agent/tags
agent/source
vendor/auth0
canonical/auth0 auth0.js
version/auth0 auth0.js/8.12.1

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Frequently Asked Questions

What is the severity of CVE-2018-6874?
CVE-2018-6874 is classified as a high severity vulnerability due to its impact on authentication processes.
How do I fix CVE-2018-6874?
To fix CVE-2018-6874, disable the Legacy Lock API flag in your Auth0 configuration.
What causes CVE-2018-6874?
CVE-2018-6874 is caused by a Cross-Site Request Forgery (CSRF) vulnerability resulting from a flaw in the Auth0 authentication service.
Which versions are affected by CVE-2018-6874?
CVE-2018-6874 affects Auth0.js versions up to and including 8.12.1 when the Legacy Lock API flag is enabled.
Is CVE-2018-6874 exploitable?
Yes, CVE-2018-6874 is exploitable if an attacker can induce a user to perform actions without their consent while authenticated.