CVE-2018-11537

Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain whitelist filter via a crafted domain.

Score

CVSS 3.0 6.5 Medium

Status

Modified - cve@mitre.org

Published

2018-06-19

Last modified

2024-08-05

Weaknesses

CWE-20

Affected products

• Angular-jwt (Auth0)

References

• https://auth0.com/docs/security/bulletins/cve-2018-11537