CVEvulnerability

CVE-2017-12677

6.1 MEDIUM Published 2017-08-08 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-08-08
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
6.1 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79

Description

IdentityServer3 2.4.x, 2.5.x, and 2.6.x before 2.6.1 has XSS in an Angular expression on the authorize response page, which might allow remote attackers to obtain sensitive information about the IdentityServer authorization response.

Affected configurations

• identityserver identityserver3 2.4.0 • identityserver identityserver3 2.5.0 • identityserver identityserver3 2.5.1 • identityserver identityserver3 2.5.2 • identityserver identityserver3 2.5.3 • identityserver identityserver3 2.6.0

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References