CVE-2019-12250: Improper Neutralization of Input During Web Page Generation

IdentityServer IdentityServer4 through 2.4 has stored XSS via the httpContext to the host/Extensions/RequestLoggerMiddleware.cs LogForErrorContext method, which can be triggered by viewing a log. NOTE: the software maintainer disputes that this is a vulnerability because the request logger is not...

Cross-site Scripting (XSS)

IdentityServer4 is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of encoding on the redirect URI on the authorization response page, causing XSS attacks to occur...

Authorization

IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations...

CVE-2018-8899

IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations...

CVE-2018-8899

IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations...

CVE-2018-8899

IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations...

CVE-2018-8899

IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations...

CVE-2018-8899

CVE-2018-8899 affects IdentityServer4: versions 1.x before 1.5.3 and 2.x before 2.1.3 do not encode the redirect URI on the authorization response page, which may allow a cross-site scripting (XSS) payload in certain configurations. The root cause is lack of encoding on the redirect URI in the au...

CVE-2018-8899: Improper Neutralization of Input During Web Page Generation

IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations...