CVE-2019-20174
1 advisory.
npm/auth0-lock CVE-2019-20174: medium 6.1, EPSS 0.72%
auth0-lock vulnerable to XSS via unsanitized placeholder property
Action: Upgrade auth0-lock to 11.21.0 or later.
npm i auth0-lock@11.21.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 11.21.0 | - |
Fixed versions
| 11.21.0 |
Sources
- osv: GHSA-w2pf-g6r8-pg22
- https://github.com/auth0/lock/security/advisories/GHSA-w2pf-g6r8-pg22
- https://nvd.nist.gov/vuln/detail/CVE-2019-20174
- https://github.com/auth0/lock/commit/6c15e5659c21cd814ea119af5c51b61399598dd5
- https://auth0.com/docs/security/bulletins/cve-2019-20174
- https://github.com/auth0/lock/releases/tag/v11.21.0
CVE-2019-20174 · published · modified · JSON