CVEvulnerability
CVE-2018-8899
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2018-03-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.1 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations.
Affected configurations
• identityserver identityserver4 (>= 1.0.0 <= 1.5.2)
• identityserver identityserver4 (>= 2.0.0 <= 2.1.2)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/IdentityServer/IdentityServer4/commit/21d0da227f50ac102de469a13bc5a15d2cc0f895 Patch, Third Party Advisory
- https://github.com/IdentityServer/IdentityServer4/issues/2164 Issue Tracking, Third Party Advisory
- https://github.com/IdentityServer/IdentityServer4/releases/tag/1.5.3 Third Party Advisory
- https://github.com/IdentityServer/IdentityServer4/releases/tag/2.1.3 Third Party Advisory
- https://github.com/IdentityServer/IdentityServer4/commit/21d0da227f50ac102de469a13bc5a15d2cc0f895 Patch, Third Party Advisory
- https://github.com/IdentityServer/IdentityServer4/issues/2164 Issue Tracking, Third Party Advisory
- https://github.com/IdentityServer/IdentityServer4/releases/tag/1.5.3 Third Party Advisory
- https://github.com/IdentityServer/IdentityServer4/releases/tag/2.1.3 Third Party Advisory