From ba2357c9010fdbcd38843e8814ac74845c390f15 Mon Sep 17 00:00:00 2001 From: Nikita Pivkin Date: Wed, 23 Sep 2026 00:18:15 +0600 Subject: [PATCH 1/2] Improve GHSA-6gg3-pmm7-97xc --- .../08/GHSA-6gg3-pmm7-97xc/GHSA-6gg3-pmm7-97xc.json | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/advisories/github-reviewed/2020/08/GHSA-6gg3-pmm7-97xc/GHSA-6gg3-pmm7-97xc.json b/advisories/github-reviewed/2020/08/GHSA-6gg3-pmm7-97xc/GHSA-6gg3-pmm7-97xc.json index 3506b2b3c88b..93216dff8e6e 100644 --- a/advisories/github-reviewed/2020/08/GHSA-6gg3-pmm7-97xc/GHSA-6gg3-pmm7-97xc.json +++ b/advisories/github-reviewed/2020/08/GHSA-6gg3-pmm7-97xc/GHSA-6gg3-pmm7-97xc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-6gg3-pmm7-97xc", - "modified": "2021-01-07T23:40:43Z", + "modified": "2023-01-09T05:03:33Z", "published": "2020-08-19T21:05:03Z", "aliases": [ "CVE-2020-15119" @@ -32,10 +32,7 @@ } ] } - ], - "database_specific": { - "last_known_affected_version_range": "<= 11.25.1" - } + ] } ], "references": [ @@ -50,13 +47,17 @@ { "type": "WEB", "url": "https://github.com/auth0/lock/commit/3711fb5b42afd40073a61a58759251f51e768b1b" + }, + { + "type": "PACKAGE", + "url": "https://github.com/auth0/lock" } ], "database_specific": { "cwe_ids": [ "CWE-79" ], - "severity": "LOW", + "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2020-08-19T21:02:01Z", "nvd_published_at": null From ff97702b6d83dbca504e51c026f1b710e0a92bf7 Mon Sep 17 00:00:00 2001 From: Nikita Pivkin Date: Wed, 23 Sep 2026 00:26:58 +0600 Subject: [PATCH 2/2] Improve GHSA-6gg3-pmm7-97xc --- .../2020/08/GHSA-6gg3-pmm7-97xc/GHSA-6gg3-pmm7-97xc.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/advisories/github-reviewed/2020/08/GHSA-6gg3-pmm7-97xc/GHSA-6gg3-pmm7-97xc.json b/advisories/github-reviewed/2020/08/GHSA-6gg3-pmm7-97xc/GHSA-6gg3-pmm7-97xc.json index 93216dff8e6e..a9dac637fb87 100644 --- a/advisories/github-reviewed/2020/08/GHSA-6gg3-pmm7-97xc/GHSA-6gg3-pmm7-97xc.json +++ b/advisories/github-reviewed/2020/08/GHSA-6gg3-pmm7-97xc/GHSA-6gg3-pmm7-97xc.json @@ -7,7 +7,7 @@ "CVE-2020-15119" ], "summary": "DOM-based XSS in auth0-lock", - "details": "### Overview\nVersions before and including `11.25.1` are using `dangerouslySetInnerHTML` to display an informational message when used with a Passwordless or Enterprise connection.\n\n- For Passwordless connection, the value of the input (email or phone number) is displayed back to the user while waiting for verification code input. \n- For Enterprise connection, the value of the input (IdP Domain) from the Enterprise connection setup screen (Auth0 Dashboard) is displayed back to the user when the `lock` widget opens.\n\nWhen Passwordless or Enterprise connection is used, the application and its users might be exposed to cross-site scripting (XSS) attacks.\n\n### Am I affected?\nYou are affected by this vulnerability if all of the following conditions apply:\n\n- You are using auth0-lock\n- You are using Passwordless or Enterprise connection mode\n\n### How to fix that?\nUpgrade to version `11.26.3`\n\n### Will this update impact my users?\nThe fix provided in patch will not affect your users.\n\n### Credit\nhttps://github.com/mvisat", + "details": "### Overview\nVersions before `11.26.3` are using `dangerouslySetInnerHTML` to display an informational message when used with a Passwordless or Enterprise connection.\n\n- For Passwordless connection, the value of the input (email or phone number) is displayed back to the user while waiting for verification code input. \n- For Enterprise connection, the value of the input (IdP Domain) from the Enterprise connection setup screen (Auth0 Dashboard) is displayed back to the user when the `lock` widget opens.\n\nWhen Passwordless or Enterprise connection is used, the application and its users might be exposed to cross-site scripting (XSS) attacks.\n\n### Am I affected?\nYou are affected by this vulnerability if all of the following conditions apply:\n\n- You are using auth0-lock\n- You are using Passwordless or Enterprise connection mode\n\n### How to fix that?\nUpgrade to version `11.26.3`\n\n### Will this update impact my users?\nThe fix provided in patch will not affect your users.\n\n### Credit\nhttps://github.com/mvisat", "severity": [ { "type": "CVSS_V3",