Okta Browser Plugin Reflected Cross-Site Scripting CVE-2024-0981

Description

Okta Browser Plugin versions 6.5.0 through 6.31.0 (Chrome/Edge/Firefox/Safari) are vulnerable to cross-site scripting. This issue occurs when the plugin prompts the user to save these credentials within Okta Personal. A fix was implemented to properly escape these fields, addressing the vulnerability. Importantly, if Okta Personal is not added to the plugin to enable multi-account view, the Workforce Identity Cloud plugin is not affected by this issue.

Affected product and versions

Okta users and customers that have currently installed versions 6.5.0 through 6.31.0 of the Okta Browser Plugin for Chrome, Edge, Firefox, and Safari and added Okta Personal to enable multi-account view.

Resolution

The vulnerability is fixed in Okta Browser Plugin version 6.32.0 for Chrome/Edge/Safari/Firefox.

Okta Admin Users can use the following query to search for users who are still using outdated versions of the plugin: debugContext.debugData.oktaUserAgentExtended ne "okta-browser-plugin/6.32.0" and debugContext.debugData.oktaUserAgentExtended co "okta-browser-plugin/"

Severity Details

This issue occurred when a user inputted new credentials and the plugin prompted to save these within Okta Personal. If Okta Personal was not added to the Okta Browser Plugin, the plugin is not affected by this issue.

CVE details