CVE-2020-5497

Опубликовано: 04 янв. 2020

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized. This is related to header.tag. The issue can be exploited to execute arbitrary JavaScript.

Ссылки

http://packetstormsecurity.com/files/156574/MITREid-1.3.3-Cross-Site-Scripting.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2020/Feb/25
Mailing List
Third Party Advisory
https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/1521
Exploit
Issue Tracking
Third Party Advisory
https://www.securitymetrics.com/blog/MITREid-Connect-cross-site-scripting-CVE-2020-5497
Exploit
Third Party Advisory
http://packetstormsecurity.com/files/156574/MITREid-1.3.3-Cross-Site-Scripting.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2020/Feb/25
Mailing List
Third Party Advisory
https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/1521
Exploit
Issue Tracking
Third Party Advisory
https://www.securitymetrics.com/blog/MITREid-Connect-cross-site-scripting-CVE-2020-5497
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:mitreid:connect:*:*:*:*:*:*:*:*

Версия до 1.3.3 (включая)

EPSS

Процентиль: 54%

0.00307

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-c2h6-7gm8-cv4w