CVE-2018-11537

    Dashboard / Vulnerabilities / CVE-2018-11537

    CVE-2018-11537

    Published: 19 Jun 2018Last Modified: 8 Jul 2026

    Summary:

    Details: Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain whitelist filter via a crafted domain.

    References: https://auth0.com/docs/security/bulletins/cve-2018-11537

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -e368cf124443507f1710f60ae855c4c54eebc6ea

    Affected versions

    0.1.9
    0.1.8
    0.1.7
    0.1.6
    0.1.5
    0.1.4
    0.1.3
    0.1.2
    0.1.1
    0.1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High