CVE-2017-7591

2017-04-0901:59:00

Google

osv.dev

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.4%

JSON

OpenIDM through 4.0.0 and 4.5.0 is vulnerable to reflected cross-site scripting (XSS) attacks within the Admin UI, as demonstrated by the _sortKeys parameter to the authzRoles script under managed/user/.

CPENameOperatorVersion
openidmeq2.0.2-docs
openidmeq4.0.0-RC2
openidmeqbackups/feature/pcunnington-authn-filter@2320
openidmeq4.0.0-RC1
openidmeqbackups/feature/OPENIDM-1331@2978
openidmeqbackups/feature/OPENIDM-1326@2977
openidmeqbackups/feature/2.1.x-CREST@2979
openidmeqbackups/feature/2.1.x-CREST-ICF-1.4@2976
openidmeq4.0.0
openidmeqbackups/feature/OPENIDM-1310-DirectAuditLogAnyTarget@2214

Name	Operator	Version
openidm	eq	2.0.2-docs
openidm	eq	4.0.0-RC2
openidm	eq	backups/feature/pcunnington-authn-filter@2320
openidm	eq	4.0.0-RC1
openidm	eq	backups/feature/OPENIDM-1331@2978
openidm	eq	backups/feature/OPENIDM-1326@2977
openidm	eq	backups/feature/2.1.x-CREST@2979
openidm	eq	backups/feature/2.1.x-CREST-ICF-1.4@2976
openidm	eq	4.0.0
openidm	eq	backups/feature/OPENIDM-1310-DirectAuditLogAnyTarget@2214