Description

The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized. This is related to header.tag. The issue can be exploited to execute arbitrary JavaScript.

Remediation

References

http://packetstormsecurity.com/files/156574/MITREid-1.3.3-Cross-Site-Scripting.html

http://seclists.org/fulldisclosure/2020/Feb/25

https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/1521

https://www.securitymetrics.com/blog/MITREid-Connect-cross-site-scripting-CVE-2020-5497

Related Vulnerabilities

CVE-2017-16135 Vulnerability in npm package serverzyy

CVE-2017-16177 Vulnerability in npm package chatbyvista

CVE-2021-28092 Vulnerability in npm package is-svg

CVE-2020-28500 Vulnerability in maven package org.webjars.bower:lodash

CVE-2021-23594 Vulnerability in npm package realms-shim

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Third Party Advisory VDB Entry Mailing List Issue Tracking