CVE-2018-8899
IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations.
参照URL
- advisory github.com
- advisory github.com
- patch github.com
- report github.com