2 lines
3.6 KiB
JSON
2 lines
3.6 KiB
JSON
{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:mitreid:connect:*:*:*:*:*:*:*:*","matchCriteriaId":"FC637AA4-26EF-4FB8-8608-6B658EBEDFF9","versionEndIncluding":"1.3.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized. This is related to header.tag. The issue can be exploited to execute arbitrary JavaScript."},{"lang":"es","value":"La implementación de referencia de OpenID Connect para MITREid Connect versiones hasta la versión 1.3.3, permite un ataque de tipo XSS debido a que userInfoJson es incluido en la página no saneada. Esto está relacionado con el archivo header.tag. El problema puede ser explotado para ejecutar un JavaScript arbitrario."}],"id":"CVE-2020-5497","lastModified":"2026-06-17T03:21:30.073","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"MEDIUM","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"NONE","baseScore":4.3,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","version":"2.0"},"exploitabilityScore":8.6,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":true}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2020-01-04T03:15:10.630","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory","VDB Entry"],"url":"http://packetstormsecurity.com/files/156574/MITREid-1.3.3-Cross-Site-Scripting.html"},{"source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"],"url":"http://seclists.org/fulldisclosure/2020/Feb/25"},{"source":"cve@mitre.org","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/1521"},{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://www.securitymetrics.com/blog/MITREid-Connect-cross-site-scripting-CVE-2020-5497"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"],"url":"http://packetstormsecurity.com/files/156574/MITREid-1.3.3-Cross-Site-Scripting.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://seclists.org/fulldisclosure/2020/Feb/25"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/1521"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://www.securitymetrics.com/blog/MITREid-Connect-cross-site-scripting-CVE-2020-5497"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"nvd@nist.gov","type":"Primary"}]}
|