CVE-2020-5497

The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized

published January 4, 2020

CVSS
—
EPSS
2%
Percentile
81.8
In the wild
Unconfirmed
What it is

The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized. This is related to header.tag. The issue can be exploited to execute arbitrary JavaScript.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02133 · 81.8th percentile
Published
2020-01-04T02:07Z
EPSS history
Timeline
  • 04 JAN 02:07Z
    The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized
    cvelistv5