CVE-2018-8899

IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations.

Score

CVSS 3.0 6.1 Medium

Status

Modified - cve@mitre.org

Published

2018-03-22

Last modified

2024-08-05

Weaknesses

CWE-79

Affected products

• Identityserver4 (Identityserver)

References

• https://github.com/IdentityServer/IdentityServer4/commit/21d0da227f50ac102de469a13bc5a15d2cc0f895
• https://github.com/IdentityServer/IdentityServer4/issues/2164
• https://github.com/IdentityServer/IdentityServer4/releases/tag/1.5.3
• https://github.com/IdentityServer/IdentityServer4/releases/tag/2.1.3