GitHub Advisoryadvisory · npm

GHSA-45fh-g845-pj9w Auth0 Passport-SharePoint does not validate JWT signature

HIGH Published 2022-05-24 Modified 2023-07-14 Official page ↗
Aliases
CVE-2019-13483
Ecosystem
npm
Packages
passport-sharepoint
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-345
Reviewed
2023-07-14

Affected packages

• npm passport-sharepoint: < 0.4.0 → fixed in 0.4.0

Description

Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. This allows attackers to forge tokens and bypass authentication and authorization mechanisms.

Related

Alias · CVE (1)

  • CVE-2019-13483 Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. vulnerability

Weakness · CWE (1)

  • CWE-345 Insufficient Verification of Data Authenticity weakness

References