CVE-2020-5263 Information disclosure through error object
An attacker can obtain plaintext passwords if the application logs or exposes the error object returned by the authentication library during failed login attempts.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-5263?
CVE-2020-5263 is a medium-severity vulnerability in auth0.js, published on 9 Apr 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an (authentication) error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the error object is exposed or logged without modification, the application risks password exposure. This is fixed in version 9.12.3
Weakness: CWE-522
Which versions are affected by CVE-2020-5263?
2 open source packages ship an affected version, including auth0-js. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
auth0-js npm | From 8.0.0 | 9.13.2 |
auth0-js npm | From 8.0.0 | 9.13.2 |
Products include Auth0 Auth0.js.
How do I fix CVE-2020-5263?
Upgrade auth0-js to 9.13.2 or later.
Is CVE-2020-5263 being exploited?
There is no known exploitation of CVE-2020-5263 in the wild and no public exploit code.
Other vulnerabilities in auth0.js
Sources
Also known as GHSA-prfq-f66g-43mp.