What is GHSA-c2h6-7gm8-cv4w?

GHSA-c2h6-7gm8-cv4w is a security advisory published by GitHub Security Advisories with Medium severity. XSS in MITREid Connect

Which CVE IDs does GHSA-c2h6-7gm8-cv4w cover?

GHSA-c2h6-7gm8-cv4w covers the following CVE IDs: CVE-2020-5497. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c2h6-7gm8-cv4w?

GHSA-c2h6-7gm8-cv4w has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-c2h6-7gm8-cv4w?

GHSA-c2h6-7gm8-cv4w affects 1 product, including: maven/org.mitre:openid-connect-server:\u003c= 1.3.3.

GHSA-c2h6-7gm8-cv4wMediumCVSS 6.1

XSS in MITREid Connect

Vendor

GitHub Security Advisories

Published

April 1, 2020

Last Modified

January 24, 2023

🔗 CVE IDs covered (1)

CVE-2020-5497 →

📋 Description

The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized. This is related to header.tag. The issue can be exploited to execute arbitrary JavaScript.

🎯 Affected products1

maven/org.mitre:openid-connect-server:<= 1.3.3

🔗 References (8)

https://nvd.nist.gov/vuln/detail/CVE-2020-5497
https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/1521
https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/pull/1526
https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/pull/1527
https://www.securitymetrics.com/blog/MITREid-Connect-cross-site-scripting-CVE-2020-5497
http://seclists.org/fulldisclosure/2020/Feb/25
http://packetstormsecurity.com/files/156574/MITREid-1.3.3-Cross-Site-Scripting.html
https://github.com/advisories/GHSA-c2h6-7gm8-cv4w