CSRF Vulnerability in Auth0 ASP.NET Packages
CVE-2018-15121

8.8HIGH

Key Information:

Vendor

Auth0

Status
Aspnet-owin
Aspnet
Vendor
CVE Published:
29 August 2018

What is CVE-2018-15121?

An issue has been identified in the Auth0 ASP.NET and Auth0 OWIN packages where they fail to use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This oversight significantly increases the risk of Cross-Site Request Forgery (CSRF) attacks during essential authentication and authorization processes, potentially allowing malicious actors to compromise user sessions.

References

https://auth0.com/docs/security/bulletins/cve-2018-15121
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.