auth0/passport-sharepoint · Security
Auth0 Passport-SharePoint does not validate JWT signature
- GHSA ID
- GHSA-45fh-g845-pj9w
- CVE ID
- CVE-2019-13483
- Severity
- high
- Published
- Updated
- CVSS
- 7.3 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- CVSS v3
- 7.3 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Description
Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. This allows attackers to forge tokens and bypass authentication and authorization mechanisms.
CWEs
- CWE-345 · Insufficient Verification of Data Authenticity