CVE Vulnerability

CVE-2019-7644

Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this error message is presented to an attacker, they can forge an arbitrary JWT token that will be accepted by the vulnerable application.

7.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://auth0.com/docs/security/bulletins/cve-2019-7644 Patch Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:auth0:auth0-wcf-service-jwt:*:*:*:*:*:*:*:*
Information

Published : 2019-04-11 08:29

Updated : 2020-08-24 05:37

NVD link : CVE-2019-7644

Mitre link : CVE-2019-7644

Products Affected
No products.
CWE
CWE-209