Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2020-15119

MEDIUM
Published 2020-08-19T21:20:11
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2020-15119. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.1
6.4
/10
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Base Score Metrics
Exploitability: N/A Impact: N/A

EPSS Score

v2025.03.14
0.003
probability
of exploitation in the wild

There is a 0.3% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-06-25
Exploit Probability
Percentile: 0.512
Higher than 51.2% of all CVEs

Attack Vector Metrics

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED

Impact Metrics

Confidentiality
HIGH
Integrity
HIGH
Availability
NONE

Description

In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting (XSS) attacks.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

auth0

lock

Affected Versions:

<= 11.25.1

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed LOW

DOM-based XSS in auth0-lock

GHSA-6gg3-pmm7-97xc

Advisory Details

### Overview Versions before and including `11.25.1` are using `dangerouslySetInnerHTML` to display an informational message when used with a Passwordless or Enterprise connection. - For Passwordless connection, the value of the input (email or phone number) is displayed back to the user while waiting for verification code input. - For Enterprise connection, the value of the input (IdP Domain) from the Enterprise connection setup screen (Auth0 Dashboard) is displayed back to the user when the `lock` widget opens. When Passwordless or Enterprise connection is used, the application and its users might be exposed to cross-site scripting (XSS) attacks. ### Am I affected? You are affected by this vulnerability if all of the following conditions apply: - You are using auth0-lock - You are using Passwordless or Enterprise connection mode ### How to fix that? Upgrade to version `11.26.3` ### Will this update impact my users? The fix provided in patch will not affect your users. ### Credit https://github.com/mvisat

Affected Packages

npm auth0-lock
ECOSYSTEM: ≥0 <11.26.3

CVSS Scoring

CVSS Score

2.5

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

References

WEB https://github.com/auth0/lock/security/advisories/GHSA-6gg3-pmm7-97xc
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2020-15119
WEB https://github.com/auth0/lock/commit/3711fb5b42afd40073a61a58759251f51e768b1b

Advisory provided by GitHub Security Advisory Database. Published: August 19, 2020, Modified: January 7, 2021

References

https://github.com/auth0/lock/security/advisories/GHSA-6gg3-pmm7-97xc
Published: 2020-08-19T21:20:11
Last Modified: 2024-08-04T13:08:21.963Z
Copied to clipboard!