7.7

CVE-2020-15125: auth0 auth0.js

CVSS: 7.7v3.1HighModified
AliasesGHSA-5jpf-pj32-xx53
Published 29-07-2020Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2020-15125 is a high (CVSS 7.7) vulnerability in auth0 auth0.js. EPSS estimates a 1.54% chance of exploitation in the next 30 days, higher than 74.5% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.7/10
010
High · v3.1 (CVE.org)
EPSS score
1.54%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 29-07-2020
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer token. You are affected by this vulnerability if you are using the auth0 npm package, and you are using a Machine to Machine application authorized to use Auth0's management API

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

1.54%

Chance of exploitation in the next 30 days

Percentile

75%

Versus all other CVEs

30-day change

0.00 pp

From 1.54% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.54%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Auth02 products
Npm1 product
  • auth0< 2.27.1

2 vendors · 3 products

References

5 links