CVE-2021-27582

org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment aka Autobinding vulnerability. This arises due to unsafe usage of the @ModelAttribute annotation during the OAuth authorization flow, in...

MITREid Connect Security Breach

Michael Stepankin OpenID-Connect-Java-Spring-Server is a GlobalMichael Stepankin open source application that provides the OpenID Connect identity provider and a generic OAuth 2.0 authorization server. A security vulnerability exists in MITREid Connect through 1.3.3, which stems from the insecure...

XSS in MITREid Connect

The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized. This is related to header.tag. The issue can be exploited to execute arbitrary JavaScript...

GHSA-C2H6-7GM8-CV4W XSS in MITREid Connect

The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized. This is related to header.tag. The issue can be exploited to execute arbitrary JavaScript...

CVE-2020-5497

The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized. This is related to header.tag. The issue can be exploited to execute arbitrary JavaScript...

CVE-2020-5497

The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized. This is related to header.tag. The issue can be exploited to execute arbitrary JavaScript...

CVE-2020-5497

The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized. This is related to header.tag. The issue can be exploited to execute arbitrary JavaScript...

CVE-2020-5497

The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized. This is related to header.tag. The issue can be exploited to execute arbitrary JavaScript...

CVE-2020-5497

The CVE-2020-5497 issue affects the MITREid Connect OpenID Connect reference implementation (OpenID-Connect-Java-Spring-Server) up to version 1.3.3. The root cause is that userInfoJson is included in the page unsanitized (related to header.tag), which enables cross-site scripting and can allow ar...

PT-2020-18479 · Mitre · Mitreid Connect

Name of the Vulnerable Software and Affected Versions: MITREid Connect versions 1.3.3 and earlier Description: The issue allows for XSS due to userInfoJson being included in the page unsanitized, related to header.tag. This can be exploited to execute arbitrary JavaScript. The user's name is...