CVE-2020-8160CWE-79

MendixSSO <= 2.1.1 contains endpoints that make use of the openid handler, which is suffering from a Cross-Site Scripting vulnerability via the URL path

published January 6, 2021

CVSS
—
EPSS
1%
Percentile
53.5
In the wild
Unconfirmed
What it is

MendixSSO <= 2.1.1 contains endpoints that make use of the openid handler, which is suffering from a Cross-Site Scripting vulnerability via the URL path. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00723 · 53.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-01-06T14:03Z
EPSS history
Timeline
  • 06 JAN 14:03Z
    MendixSSO <= 2.1.1 contains endpoints that make use of the openid handler, which is suffering from a Cross-Site Scripting vulnerability via the URL path
    cvelistv5