CVE-2018-8899 IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations.
MediumCVSS 6.1
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| identityserver4 | >= 1.0.0, <= 1.5.2 | No fix listed |
| identityserver4 | >= 2.0.0, <= 2.1.2 | No fix listed |
References
- github.com patch third-party-advisory
- github.com issue-tracking third-party-advisory
- github.com third-party-advisory
- github.com third-party-advisory