CVE-2017-17068 auth0-js Privilege Escalation Vulnerability

What is CVE-2017-17068?

CVE-2017-17068 is a high-severity vulnerability in n/a, published on 6 Dec 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's behalf if the target site or application uses a popup callback page with auth0.popup.callback().

Weakness: CWE-200

Which versions are affected by CVE-2017-17068?

2 open source packages ship an affected version, including auth0-js. It affects 1 product.

Products include Auth0 Auth0.js.

How do I fix CVE-2017-17068?

Upgrade auth0-js to 8.12.0 or later.

Is CVE-2017-17068 being exploited?

There is no known exploitation of CVE-2017-17068 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2018-6873 Auth bypass in n/a Critical 9.8
• CVE-2018-6874 Cross-Site Request Forgery (CSRF) in Auth0 High 8.8
• CVE-2018-7307 Auth0-js bypasses CSRF checks High 8.8
• CVE-2020-15125 Authorization header is not sanitized in an error object in auth0 High 7.7
• CVE-2026-42280 Improper Permission Checking in Auth.js SDK High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3rpr-mg43-xhq4.