CVE-2024-21637
XSS in Authentik via JavaScript-URI as Redirect URI and form_post Response Mode
Résumé
XSS in Authentik via JavaScript-URI as Redirect URI and form_post Response Mode
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Authentik is an open-source Identity Provider. Authentik is a vulnerable to a reflected Cross-Site Scripting vulnerability via JavaScript-URIs in OpenID Connect flows with response_mode=form_post. This relatively user could use the described attacks to perform a privilege escalation. This vulnerability has been patched in versions 2023.10.6 and 2023.8.6.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
authentik
[{"type":"SEMVER","events":[{"introduced":"2023.8.0"},{"fixed":"2023.8.6"},{"introduced":"2023.10.0"},{"fixed":"2023.10.6"}]}]
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- web github.com
- web github.com