CVE-2021-28290

2022-05-1118:15:22

Google

osv.dev

5.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.2%

JSON

A cross-site scripting (XSS) vulnerability in Skoruba IdentityServer4.Admin before 2.0.0 via unencoded value passed to the data-secret-value parameter.

CPENameOperatorVersion
identityserver4.admineq1.0.0-beta2
identityserver4.admineq1.0.0-rc4
identityserver4.admineq1.0.0-beta1
identityserver4.admineq1.0.0
identityserver4.admineq1.0.0-rc2
identityserver4.admineq1.0.0-beta5
identityserver4.admineq2.0.0-preview-beta1
identityserver4.admineq1.0.0-rc1
identityserver4.admineq1.0.0-beta3
identityserver4.admineq1.0.0-beta4

Name	Operator	Version
identityserver4.admin	eq	1.0.0-beta2
identityserver4.admin	eq	1.0.0-rc4
identityserver4.admin	eq	1.0.0-beta1
identityserver4.admin	eq	1.0.0
identityserver4.admin	eq	1.0.0-rc2
identityserver4.admin	eq	1.0.0-beta5
identityserver4.admin	eq	2.0.0-preview-beta1
identityserver4.admin	eq	1.0.0-rc1
identityserver4.admin	eq	1.0.0-beta3
identityserver4.admin	eq	1.0.0-beta4