Cross Site Scripting (XSS)

2022-08-3008:26:48

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross site scripting

input validation

malicious payload

redirect uri

0.002 Low

EPSS

Percentile

54.2%

JSON

authing/oauth2-server is vulnerable to cross-site scripting. The vulnerability exists in the uri parameter in is.js due to improper input validation in redirect_uri parameters which allows a malicious user to inject and execute a maliciously crafted payload.

CPENameOperatorVersion
@authing/oauth2-servereq3.1.0
@authing/oauth2-servereq3.1.0

CPE	Name	Operator	Version
	@authing/oauth2-server	eq	3.1.0
	@authing/oauth2-server	eq	3.1.0

References

github.com/advisories/GHSA-4rg6-fm25-gc34

github.com/oauthjs/node-oauth2-server/blob/91d2cbe70a0eddc53d72def96864e2de0fd41703/lib/grant-types/authorization-code-grant-type.js#L143

github.com/oauthjs/node-oauth2-server/blob/91d2cbe70a0eddc53d72def96864e2de0fd41703/lib/validator/is.js#L12

github.com/oauthjs/node-oauth2-server/issues/637

tools.ietf.org/html/rfc3986#section-3

tools.ietf.org/html/rfc6749#section-3.1.2

0.002 Low

EPSS

Percentile

54.2%

JSON

Related for VERACODE:36851