Description

Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder.

Remediation

References

https://auth0.com/docs/security/bulletins/cve-2019-20174

https://github.com/auth0/lock/releases/tag/v11.21.0

Related Vulnerabilities

CVE-2021-23327 Vulnerability in maven package org.webjars.npm:apexcharts

CVE-2023-28672 Vulnerability in maven package org.jenkinsci.plugins:octoperf

CVE-2023-30527 Vulnerability in maven package org.jenkins-ci.plugins:wso2id-oauth

CVE-2023-46233 Vulnerability in maven package org.webjars.npm:github-com-brix-crypto-js

CVE-2021-32736 Vulnerability in npm package think-helper

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Vendor Advisory Release Notes Third Party Advisory CWE-79