PT-2020-18479 · Mitre · Mitreid Connect

Aaron Bishop · Published 2020-01-04 · Updated 2023-01-24 · CVE-2020-5497

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MITREid Connect versions 1.3.3 and earlier

Description The issue allows for XSS due to userInfoJson being included in the page unsanitized, related to header.tag. This can be exploited to execute arbitrary JavaScript. The user's name is included in topbar.tag and header.tag without being sanitized.

Recommendations For versions 1.3.3 and earlier, consider sanitizing the userInfoJson to prevent XSS attacks. As a temporary workaround, restrict the use of header.tag and topbar.tag to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-5497

GHSA-C2H6-7GM8-CV4W

Affected Products

Mitreid Connect

References · 12

• 🔥 https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/1521 · Exploit
• 🔥 https://securitymetrics.com/blog/MITREid-Connect-cross-site-scripting-CVE-2020-5497 · Exploit
• 🔥 http://packetstormsecurity.com/files/156574/MITREid-1.3.3-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-5497 · Security Note
• https://osv.dev/vulnerability/GHSA-c2h6-7gm8-cv4w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5497 · Vendor Advisory
• https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/pull/1526 · Note
• https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/pull/1527 · Note
• https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server · Note
• https://t.me/defcon_news/39939 · Telegram Post
• https://t.me/cybersecuritytechnologies/713 · Telegram Post
• http://seclists.org/fulldisclosure/2020/Feb/25 · Note