GitHub Advisoryadvisory · NuGet

GHSA-mmhr-3jr7-qj2p Auth0-ASPNET and Auth0-ASPNET-Owin vulnerable to Cross-Site Request Forgery

HIGH Published 2022-05-14 Modified 2023-05-24 Official page ↗
Aliases
CVE-2018-15121
Ecosystem
NuGet
Packages
Auth0-ASPNET-Owin, auth0-aspnet
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2023-05-24

Affected packages

• NuGet Auth0-ASPNET-Owin: <= 2.3.2 (no fix yet) • NuGet auth0-aspnet: <= 2.1.1 (no fix yet)

Description

An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations.

Related

Alias · CVE (1)

  • CVE-2018-15121 An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References