Description
Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain whitelist filter via a crafted domain.
Remediation
References
https://auth0.com/docs/security/bulletins/cve-2018-11537
Related Vulnerabilities
CVE-2023-37903 Vulnerability in maven package org.webjars.npm:vm2
CVE-2012-4431 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core
CVE-2021-39135 Vulnerability in npm package @npmcli/arborist
CVE-2019-3772 Vulnerability in maven package org.springframework.integration:spring-integration-ws