CVE-2018-8899

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2018-8899
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-8899.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-8899
Published
2018-03-22T05:29:00Z
Modified
2026-10-20T10:49:30Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations.

References

Affected packages

Git / github.com/DuendeArchive/IdentityServer4

Affected ranges

Type
GIT
Repo
https://github.com/DuendeArchive/IdentityServer4
Events
Introduced
62eea365e8835323230c32eff6ec9b7b78cc1be0
Last Affected
b9f179103be2d8708131394527cebc1e9f6b17aa
Introduced
1b88084c06eb6a0368ccec9fed7c9a295f1d508b
Last Affected
becb2206826b1039687b3ec895fad5e1b26ef0c5
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:identityserver:identityserver4:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0"
                },
                {
                    "last_affected":  "1.5.2"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:identityserver:identityserver4:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.0.0"
                },
                {
                    "last_affected":  "2.1.2"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}

Affected versions

2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.1.0
2.1.1
2.1.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-8899.json"

Git / github.com/duendearchive/identityserver4

Affected ranges

Type
GIT
Repo
https://github.com/duendearchive/identityserver4
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
21d0da227f50ac102de469a13bc5a15d2cc0f895
Fixed
02e7b1db08ea20483fa84f0087612f9d7c57d7e7
Fixed
35ac1ac2d8f62cc3c6b2602bb653c3e651cdcfd8
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "fixed":  "21d0da227f50ac102de469a13bc5a15d2cc0f895"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "1.5.3",
            "range":  [
                {
                    "fixed":  "02e7b1db08ea20483fa84f0087612f9d7c57d7e7"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "2.1.3",
            "range":  [
                {
                    "fixed":  "35ac1ac2d8f62cc3c6b2602bb653c3e651cdcfd8"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

1.*
1.0.0-beta1
1.0.0-rc1
1.0.0-rc1-update1
1.0.0-rc1-update2
1.0.0-rc2
1.0.0-rc3
1.0.0-rc4
1.0.1
1.0.2
1.1.0
1.1.1
1.2
1.2.0
1.2.1
1.3.0
1.3.1
1.4.1
1.4.2
1.5.0
2.*
2.0.0
2.0.0-rc1
2.0.0-rc1-update1
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.1.0
2.1.1
2.1.2
Other
beta1-update1
beta2
beta2-update2
beta3
beta4
beta4-update1
beta4-update2
beta5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-8899.json"