CVE-2018-7307: CSRF
Published Mar 6, 2018
·Updated
The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter.
Affected Software
1 affected component
Auth0 auth0.js<9.3
Event History
Mar 6, 2018
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Data Sourced
via NVD·03:29 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2018-7307?
CVE-2018-7307 is classified as a medium severity vulnerability due to its potential for CSRF attacks.
2
How do I fix CVE-2018-7307?
To fix CVE-2018-7307, upgrade the Auth0.js library to version 9.3 or later.
3
What types of attacks can CVE-2018-7307 lead to?
CVE-2018-7307 can lead to CSRF attacks if the authorization response does not include the state parameter.
4
What versions of Auth0.js are affected by CVE-2018-7307?
CVE-2018-7307 affects all versions of Auth0.js prior to 9.3.
5
Is there a workaround for CVE-2018-7307?
There are no known effective workarounds for CVE-2018-7307 aside from upgrading to a secure version.