GitHub Advisoryadvisory · NuGet

GHSA-qpvx-gpqm-g98j Critical severity vulnerability that affects Auth0-WCF-Service-JWT

CRITICAL Published 2019-04-18 Modified 2021-09-16 Official page ↗
Aliases
CVE-2019-7644
Ecosystem
NuGet
Packages
Auth0-WCF-Service-JWT
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-209
Reviewed
2020-06-16

Affected packages

• NuGet Auth0-WCF-Service-JWT: < 1.0.4 → fixed in 1.0.4

Description

Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this error message is presented to an attacker, they can forge an arbitrary JWT token that will be accepted by the vulnerable application.

Related

Alias · CVE (1)

  • CVE-2019-7644 Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT… vulnerability

Weakness · CWE (1)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References