Vulnerabilities

TI-2021-08394 CVE-2021-26715 · GHSA-792r-mh2q-p8qp

The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a…

MEDIUM 42

The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01494 Published 2021-03-25 No fix listed CWE-918

TI-2021-09034 CVE-2021-27582 · GHSA-8p36-q63g-68qh

org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server…

MEDIUM 44

org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment (aka Autobinding) vulnerability.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.02222 Published 2021-02-23 No fix listed CWE-1321

TI-2020-04475 CVE-2020-5497 · GHSA-c2h6-7gm8-cv4w

The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS…

LOW 31

The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02133 Published 2020-01-04 No fix listed CWE-79

Vulnerabilities

Filters

The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a…

org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server…

The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS…