From c9e43e624fd2634fb0b976373da11c63f82cf3db Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 13 Sep 2023 22:15:21 +0000 Subject: [PATCH] Publish GHSA-3rpr-mg43-xhq4 --- .../12/GHSA-3rpr-mg43-xhq4/GHSA-3rpr-mg43-xhq4.json | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/advisories/github-reviewed/2017/12/GHSA-3rpr-mg43-xhq4/GHSA-3rpr-mg43-xhq4.json b/advisories/github-reviewed/2017/12/GHSA-3rpr-mg43-xhq4/GHSA-3rpr-mg43-xhq4.json index 6eeea1c7de8..24f4c247489 100644 --- a/advisories/github-reviewed/2017/12/GHSA-3rpr-mg43-xhq4/GHSA-3rpr-mg43-xhq4.json +++ b/advisories/github-reviewed/2017/12/GHSA-3rpr-mg43-xhq4/GHSA-3rpr-mg43-xhq4.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-3rpr-mg43-xhq4", - "modified": "2021-08-31T21:24:03Z", + "modified": "2023-09-13T22:14:09Z", "published": "2017-12-21T00:47:20Z", "aliases": [ "CVE-2017-17068" ], - "summary": "High severity vulnerability that affects auth0-js", - "details": "A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's behalf if the target site or application uses a popup callback page with auth0.popup.callback().", + "summary": "auth0-js Privilege Escalation Vulnerability", + "details": "A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's behalf if the target site or application uses a popup callback page with `auth0.popup.callback()`.", "severity": [ { "type": "CVSS_V3", @@ -20,6 +20,11 @@ "ecosystem": "npm", "name": "auth0-js" }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, "ranges": [ { "type": "ECOSYSTEM",