CVE-2018-7307

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Mar 6, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-73088.8A CSRF issue was found in var/www/html/files.php in DanWin hosting through 2018-02-11 that allows arbitrary remote users to add/delete/modifCVE-2018-73118.8PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability. The software installs a privileged helper tool that runsCVE-2018-73129.8SQL Injection exists in the Alexandria Book Library 3.1.2 component for Joomla! via the letter parameter.CVE-2018-73139.8SQL Injection exists in the CW Tags 2.0.6 component for Joomla! via the searchtext array parameter.CVE-2018-73149.8SQL Injection exists in the PrayerCenter 3.0.2 component for Joomla! via the sessionid parameter, a different vulnerability than CVE-2008-64CVE-2018-73159.8SQL Injection exists in the Ek Rishta 2.9 component for Joomla! via the gender, age1, age2, religion, mothertounge, caste, or country parameCVE-2018-73169.8Arbitrary File Upload exists in the Proclaim 9.1.1 component for Joomla! via a mediafileform action.CVE-2018-73177.5Backup Download exists in the Proclaim 9.1.1 component for Joomla! via a direct request for a .sql file under backup/.CVE-2018-73189.8SQL Injection exists in the CheckList 1.1.1 component for Joomla! via the title_search, tag_search, name_search, description_search, or filtCVE-2018-73199.8SQL Injection exists in the OS Property Real Estate 3.12.7 component for Joomla! via the cooling_system1, heating_system1, or laundry parameCVE-2018-73207.5In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the SIGCOMP protocol dissector could crash. This was addressed in epan/dissectors/packet-siCVE-2018-73217.5In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-thrift.c had a large loop that was addressed by not proceeding with
CVE-2018-7307: High severity, CVSS 8.8 | Vulnix