Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:29838
HistoryMar 26, 2021 - 3:53 a.m.

Server Side Request Forgery (SSRF)

2021-03-2603:53:15
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
6

0.002 Low

EPSS

Percentile

55.3%

MITREid Connect is vulnerable to Server Side Request Forgery (SSRF). An attacker is able to request any URL accessible from the authorization server and display its content, leading to a Server Side Request Forgery attack via logo_uri parameter during registration process. Moreover, a lack of enforcement for any image “Content-Type” header allows an attacker to display arbitrary HTML content from their own URL. If this HTML contains malicious JavaScript code, it will be executed within the authorization server domain.

CPENameOperatorVersion
openid connect server libraryle1.3.3

0.002 Low

EPSS

Percentile

55.3%

Related for VERACODE:29838