CVE-2018-8899

medium

Description

IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations.

References

Advisories

https://github.com/IdentityServer/IdentityServer4/releases/tag/2.1.3

https://github.com/IdentityServer/IdentityServer4/releases/tag/1.5.3

https://github.com/IdentityServer/IdentityServer4/issues/2164

https://github.com/IdentityServer/IdentityServer4/commit/21d0da227f50ac102de469a13bc5a15d2cc0f895

Details

Source: Mitre, NVD

Published: 2018-03-22

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N