Description
Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain whitelist filter via a crafted domain.
Remediation
References
https://auth0.com/docs/security/bulletins/cve-2018-11537
Related Vulnerabilities
CVE-2017-16003 Vulnerability in npm package windows-build-tools
CVE-2023-43668 Vulnerability in maven package org.apache.inlong:manager-pojo
CVE-2023-24450 Vulnerability in maven package org.jenkins-ci.plugins:view-cloner
CVE-2022-28220 Vulnerability in maven package org.apache.james.protocols:protocols-netty