CVE-2018-15121

Description

An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations.

Risk Information

Base Score

8.8

MODERATE

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.141

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2018-15121 are affected in Nuget - auth0-aspnet 2.1.1	Windows
Vulnerabilities CVE-2018-15121 are affected in Nuget - Auth0-ASPNET-Owin 2.3.2	Windows
Vulnerabilities CVE-2018-15121 are affected in Nuget - auth0-aspnet for Linux 2.1.1	Linux
Vulnerabilities CVE-2018-15121 are affected in Nuget - Auth0-ASPNET-Owin for Linux 2.3.2	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234