p PatchFirst

GHSA-hjfh-5jmm-xr24

GHSA-hjfh-5jmm-xr24 · laravel-auth0 SDK Does Not Properly Handle File Types in Bulk User Import

This page contains facts from public vulnerability sources. Check the original advisory before updating.

### Overview In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. ### Am I affected? You are affected by this vulnerability if you meet the following preconditions: 1. Applications using the Auth0 laravel-auth0 SDK with version between 4.0.0 and 7.18.0, 2. Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0. ### Fix Upgrade Auth0 laravel-auth0 SDK to version 7.19.0 or greater. ### Acknowledgement Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.

CVSS 3.3 · Low · Fix available

Published
Updated

Stack: php

Affected products and versions

  • auth0/login Packagist

    Versions
    • 4.0.0
    • 4.0.1
    • 4.0.2
    • 4.0.3
    • 4.0.4
    • 4.0.5
    • 4.0.6
    • 4.0.7
    • 4.0.8
    • 5.0.0
    • 5.0.1
    • 5.0.2
    • 5.1.0
    • 5.2.0
    • 5.3.0
    • 5.3.1
    • 5.4.0
    • 6.0.0
    • 6.0.1
    • 6.1.0
    • 6.2.0
    • 6.3.0
    • 6.4.0
    • 6.4.1
    • 6.5.0
    • 7.0.0
    • 7.0.0-BETA1
    • 7.0.0-BETA2
    • 7.0.1
    • 7.1.0
    • 7.10.0
    • 7.10.1
    • 7.11.0
    • 7.12.0
    • 7.13.0
    • 7.14.0
    • 7.15.0
    • 7.16.0
    • 7.17.0
    • 7.18.0
    • 7.2.0
    • 7.2.1
    • 7.2.2
    • 7.3.0
    • 7.4.0
    • 7.5.0
    • 7.5.1
    • 7.5.2
    • 7.6.0
    • 7.7.0
    • 7.8.0
    • 7.8.1
    • 7.9.0
    • 7.9.1
    Affected ranges
    • ECOSYSTEM: ≥ 4.0.0, < 7.19.0

    Update to 7.19.0

Original sources

Check your server →