CVE Vulnerability

CVE-2021-32702

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including `1.4.1` are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the `error` query parameter which is then processed by the callback handler as an error message. You are affected by this vulnerability if you are using `@auth0/nextjs-auth0` version `1.4.1` or lower **unless** you are using custom error handling that does not return the error message in an HTML response. Upgrade to version `1.4.1` to resolve. The fix adds basic HTML escaping to the error message and it should not impact your users.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

6.1 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/auth0/nextjs-auth0/commit/6996e2528ceed98627caa28abafbc09e90163ccf Patch Third Party Advisory
https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-954c-jjx6-cxv7 Third Party Advisory
https://www.npmjs.com/package/@auth0/nextjs-auth0 Product Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:auth0:nextjs-auth0:*:*:*:*:*:node.js:*:*
Information

Published : 2021-06-25 05:15

Updated : 2021-07-01 07:29

NVD link : CVE-2021-32702

Mitre link : CVE-2021-32702

Products Affected
No products.
CWE
CWE-79