Is CVE-2020-5263 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-5263 being exploited in the wild.

How severe is CVE-2020-5263?

Low severity, with a CVSS score of 3.1, published 10 April 2020.

Which products and versions are affected?

auth0-js (npm) SEMVER:introduced=8.0.0,fixed=9.13.2.

Is there a fix for CVE-2020-5263?

Yes. auth0-js (npm): upgrade to 9.13.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-5263 attacked?

It is attacked with local access.

Am I affected by CVE-2020-5263?

Check whether you run auth0-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-5263: Auth0 auth0.js information disclosure in error object

CVE-2020-5263 · Severity: low · CVSS 3.1 · Published 2020-04-10

Auth0.js is a JavaScript library used by developers to add authentication to web applications. In versions 8.0.0 through 9.13.1, authentication error messages inadvertently included users' plaintext passwords. If these error objects are logged, displayed, or stored by the application, attackers who gain access to logs or error reports could steal user credentials and compromise accounts.

Technologies: auth0-js (npm). Vendors: npm.

Quick answers

Is CVE-2020-5263 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-5263 being exploited in the wild.
How severe is CVE-2020-5263?: Low severity, with a CVSS score of 3.1, published 10 April 2020.
Which products and versions are affected?: auth0-js (npm) SEMVER:introduced=8.0.0,fixed=9.13.2.
Is there a fix for CVE-2020-5263?: Yes. auth0-js (npm): upgrade to 9.13.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-5263 attacked?: It is attacked with local access.
Am I affected by CVE-2020-5263?: Check whether you run auth0-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

auth0-js (npm): upgrade to 9.13.2 or later
```
npm install auth0-js@9.13.2
```

Technical details

This vulnerability is an information disclosure flaw (CWE-522) in the auth0.js library's error handling. When authentication fails, the error object returned by the library contains the original user request, including any plaintext passwords entered by the user. The vulnerability affects versions 8.0.0 through 9.13.1 and has no special preconditions beyond using an affected version and storing/displaying the error object without sanitization. An attacker who can access application logs, error reports, or error messages displayed to administrators can extract plaintext passwords from the error objects. The fix was released in version 9.13.2, which masks user-entered passwords in error objects.

Affected products

Auth0 auth0.js 8.0.0 to 9.13.1

Identifiers

CVE-2020-5263
GHSA-prfq-f66g-43mp

Timeline

2020-04-09: disclosed
2020-04-10: patched: Version 9.13.2 released with password masking in error objects

References

https://github.com/auth0/auth0.js/security/advisories/GHSA-prfq-f66g-43mp

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.