CVE-2020-15119: DOM-based XSS in auth0-lock
In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting (XSS) attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-15119?
CVE-2020-15119 is rated as a high severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2020-15119?
To mitigate CVE-2020-15119, update Auth0 Lock to version 11.26.0 or later where the use of dangerouslySetInnerHTML is addressed.
What versions of Auth0 Lock are affected by CVE-2020-15119?
CVE-2020-15119 affects all versions of Auth0 Lock up to and including version 11.25.1.
What type of vulnerability is CVE-2020-15119?
CVE-2020-15119 is classified as a cross-site scripting (XSS) vulnerability.
What are the potential consequences of CVE-2020-15119?
The exploitation of CVE-2020-15119 may allow attackers to execute arbitrary scripts in the context of the user's session, leading to data theft or session hijacking.