Auth0 XSRF Vulnerability

Auth0 have disclosed a vulnerability in the auth0-aspnet and auth0-aspnet-owin packages. Applications that use these packages may be vulnerable to Cross-Site Request Forgery (XSRF) attacks.

Threat ID:: CC-2647
Category:
Threat Severity:: Medium
Threat Vector:
Published:: 3 September 2018 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

Auth0 have disclosed a vulnerability in the auth0-aspnet and auth0-aspnet-owin packages. Applications that use these packages may be vulnerable to Cross-Site Request Forgery (XSRF) attacks.

Affected platforms

The following platforms are known to be affected:

OAuth

OAuth - Version 2.0 and earlier
OpenID Connect - All versions

OpenID Connect

Threat details

These could occur during authorisation and authentication operations.

For further information

CVE 2018-15121

Remediation steps

Type	Step
	Auth0 have stated that both packages have been discontinued, and recommend users migrate to OWIN 4. Please see Auth0's migration guide, as well as their Security Bulletin CVE 2018-15121, for further advice.

CVE Vulnerabilities

Status

CVE-2018-15121

Last edited: 17 February 2020 12:38 pm