CVE-2022-29172

Auth0 is an authentication broker that supports both social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. In versions before `11.33.0`, when the “additional signup fields� feature [is configured](https://github.com/auth0/lock#additional-sign-up-fields), a malicious actor can inject invalidated HTML code into these additional fields, which is then stored in the service `user_metdata` payload (using the `name` property). Verification emails, when applicable, are generated using this metadata. It is therefor possible for an actor to craft a malicious link by injecting HTML, which is then rendered as the recipient's name within the delivered email template. You are impacted by this vulnerability if you are using `auth0-lock` version `11.32.2` or lower and are using the “additional signup fields� feature in your application. Upgrade to version `11.33.0`.
Configurations

Configuration 1 (hide)

cpe:2.3:a:auth0:lock:*:*:*:*:*:node.js:*:*

History

16 May 2022, 17:32

Type Values Removed Values Added
First Time Auth0
Auth0 lock
CWE CWE-79
References (CONFIRM) https://github.com/auth0/lock/security/advisories/GHSA-7ww6-75fj-jcj7 - (CONFIRM) https://github.com/auth0/lock/security/advisories/GHSA-7ww6-75fj-jcj7 - Third Party Advisory
References (MISC) https://github.com/auth0/lock/commit/79ae557d331274b114848150f19832ae341771b1 - (MISC) https://github.com/auth0/lock/commit/79ae557d331274b114848150f19832ae341771b1 - Patch, Third Party Advisory
CVSS v2 : unknown
v3 : unknown
v2 : 2.6
v3 : 6.1
CPE cpe:2.3:a:auth0:lock:*:*:*:*:*:node.js:*:*

05 May 2022, 23:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-05-05 23:15

Updated : 2022-05-16 23:23


NVD link : CVE-2022-29172

Mitre link : CVE-2022-29172


JSON object : View

Products Affected

auth0

  • lock
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')