Vulnerabilities

TI-2019-09138 CVE-2019-12250 · GHSA-jg67-mr48-c26q

IdentityServer IdentityServer4 through 2.4 has stored XSS via the httpContext to the…

LOW 29

IdentityServer IdentityServer4 through 2.4 has stored XSS via the httpContext to the host/Extensions/RequestLoggerMiddleware.cs LogForErrorContext method, which can be triggered by viewing a log.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00848 Published 2019-05-21 No fix listed CWE-79

TI-2018-06438 CVE-2018-8899 · GHSA-mvpr-3vvr-7vqx

IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the…

LOW 30

IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01215 Published 2018-03-22 No fix listed CWE-79

TI-2017-09396 CVE-2017-12677 · GHSA-gf3v-79w2-h666

IdentityServer3 2.4.x, 2.5.x, and 2.6.x before 2.6.1 has XSS in an Angular expression on…

LOW 29

IdentityServer3 2.4.x, 2.5.x, and 2.6.x before 2.6.1 has XSS in an Angular expression on the authorize response page, which might allow remote attackers to obtain sensitive information about the IdentityServer authorizat…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01042 Published 2017-08-08 No fix listed CWE-79

Vulnerabilities

Filters

IdentityServer IdentityServer4 through 2.4 has stored XSS via the httpContext to the…

IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the…

IdentityServer3 2.4.x, 2.5.x, and 2.6.x before 2.6.1 has XSS in an Angular expression on…