CVE-2018-8899

Опубликовано: 22 мар. 2018

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations.

Ссылки

https://github.com/IdentityServer/IdentityServer4/commit/21d0da227f50ac102de469a13bc5a15d2cc0f895
Patch
Third Party Advisory
https://github.com/IdentityServer/IdentityServer4/issues/2164
Issue Tracking
Third Party Advisory
https://github.com/IdentityServer/IdentityServer4/releases/tag/1.5.3
Third Party Advisory
https://github.com/IdentityServer/IdentityServer4/releases/tag/2.1.3
Third Party Advisory
https://github.com/IdentityServer/IdentityServer4/commit/21d0da227f50ac102de469a13bc5a15d2cc0f895
Patch
Third Party Advisory
https://github.com/IdentityServer/IdentityServer4/issues/2164
Issue Tracking
Third Party Advisory
https://github.com/IdentityServer/IdentityServer4/releases/tag/1.5.3
Third Party Advisory
https://github.com/IdentityServer/IdentityServer4/releases/tag/2.1.3
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:identityserver:identityserver4:*:*:*:*:*:*:*:*

Версия от 1.0.0 (включая) до 1.5.2 (включая)

cpe:2.3:a:identityserver:identityserver4:*:*:*:*:*:*:*:*

Версия от 2.0.0 (включая) до 2.1.2 (включая)

EPSS

Процентиль: 52%

0.00294

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-mvpr-3vvr-7vqx