CVE-2018-8899

IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations.

CVSS v3 6.1 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/IdentityServer/IdentityServer4/commit/21d0da227f50ac102de469a13bc5a15d2cc0f895	Patch Third Party Advisory
https://github.com/IdentityServer/IdentityServer4/issues/2164	Issue Tracking Third Party Advisory
https://github.com/IdentityServer/IdentityServer4/releases/tag/1.5.3	Third Party Advisory
https://github.com/IdentityServer/IdentityServer4/releases/tag/2.1.3	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:identityserver:identityserver4::::::::
	cpe:2.3:a:identityserver:identityserver4::::::::

History

No history.

Information

Published : 2018-03-22 05:29

Updated : 2024-02-04 19:46

NVD link : CVE-2018-8899

Mitre link : CVE-2018-8899

CVE.ORG link : CVE-2018-8899

JSON object : View

Products Affected

identityserver

identityserver4

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2018-8899", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2018-03-22T05:29:00.287", "references": [{"url": "https://github.com/IdentityServer/IdentityServer4/commit/21d0da227f50ac102de469a13bc5a15d2cc0f895", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/IdentityServer/IdentityServer4/issues/2164", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/IdentityServer/IdentityServer4/releases/tag/1.5.3", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/IdentityServer/IdentityServer4/releases/tag/2.1.3", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations."}, {"lang": "es", "value": "IdentityServer IdentityServer4, en versiones 1.x anteriores a la 1.5.3 y 2.x anteriores a la 2.1.3, no cifra el URI de redirecci\u00f3n en la p\u00e1gina de respuesta de autorizaci\u00f3n. Esto podr\u00eda conducir a Cross-Site Scripting (XSS) en algunas configuraciones."}], "lastModified": "2018-04-18T01:28:51.507", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:identityserver:identityserver4:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AFBF1F40-0032-4A48-B2BD-8DC2C9397CBA", "versionEndIncluding": "1.5.2", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:identityserver:identityserver4:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "08D8FCA9-C767-452D-A5F3-D3F721650214", "versionEndIncluding": "2.1.2", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}