GitHub Advisoryadvisory · Maven

GHSA-c2h6-7gm8-cv4w XSS in MITREid Connect

MEDIUM Published 2020-04-01 Modified 2023-01-24 Official page ↗
Aliases
CVE-2020-5497
Ecosystem
Maven
Packages
org.mitre:openid-connect-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-04-01

Affected packages

• Maven org.mitre:openid-connect-server: <= 1.3.3 (no fix yet)

Description

The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized. This is related to header.tag. The issue can be exploited to execute arbitrary JavaScript.

Related

Alias · CVE (1)

  • CVE-2020-5497 The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References