Executive Summary

Informations
Name CVE-2020-15084 First vendor Publication 2020-06-30
Vendor Cve Last vendor Modification 2020-07-08

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Overall CVSS Score 9.1
Base Score 9.1 Environmental Score 9.1
impact SubScore 5.2 Temporal Score 9.1
Exploitabality Sub Score 3.9
 
Attack Vector Network Attack Complexity Low
Privileges Required None User Interaction None
Scope Unchanged Confidentiality Impact High
Integrity Impact High Availability Impact None
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Cvss Base Score 4.3 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this vulnerability if all of the following conditions apply: - You are using express-jwt - You do not have **algorithms** configured in your express-jwt configuration. - You are using libraries such as jwks-rsa as the **secret**. You can fix this by specifying **algorithms** in the express-jwt configuration. See linked GHSA for example. This is also fixed in version 6.0.0.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15084

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-285 Improper Access Control (Authorization)

Sources (Detail)

Source Url
CONFIRM https://github.com/auth0/express-jwt/security/advisories/GHSA-6g6m-m6h5-w9gf
MISC https://github.com/auth0/express-jwt/commit/7ecab5f8f0cab5297c2b863596566eb0c...

Alert History

If you want to see full details history, please login or register.
0
1
Date Informations
2020-07-08 21:23:02
  • Multiple Updates
2020-06-30 21:23:00
  • First insertion