Skip to content
Fencer Intel
critical —

GHSA-c42h-56wx-h85q json

laravel-auth0 SDK Deserialization of Untrusted Data vulnerability

published last yr. modified 9mo ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

**Overview** The laravel-auth0 SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.

**Am I Affected?** You are affected by this vulnerability if you meet the following preconditions:

1. Applications using laravel-auth0 SDK, versions between 7.0.0-BETA1 to 7.2.1. 2. Laravel-auth0 SDK uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0.

**Fix** Upgrade Auth0/laravel-auth0 to the latest version (v7.17.0).

**Acknowledgement** Okta would like to thank Andreas Forsblom for discovering this vulnerability.

Patch / fix

  • packagist auth0/login 7.2.2

Is GHSA-c42h-56wx-h85q in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
packagist auth0/login
>=7.0.0-BETA1, <7.2.2
7.2.2

Classification

Weakness
  • CWE-1395 Dependency on Vulnerable Third-Party Component
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.