CVE-2020-15125: Authorization header is not sanitized in an error object in auth0
In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer token. You are affected by this vulnerability if you are using the auth0 npm package, and you are using a Machine to Machine application authorized to use Auth0's management API
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-15125?
CVE-2020-15125 is classified as a medium severity vulnerability due to the potential exposure of sensitive data.
How do I fix CVE-2020-15125?
To fix CVE-2020-15125, upgrade the auth0 package to version 2.27.1 or later.
What versions are affected by CVE-2020-15125?
CVE-2020-15125 affects auth0 (npm package) versions prior to 2.27.1.
What type of vulnerability is CVE-2020-15125?
CVE-2020-15125 is a data exposure vulnerability caused by improper sanitization of the Authorization header.
In which package is CVE-2020-15125 found?
CVE-2020-15125 is found in the auth0.js package, specifically versions before 2.27.1.