DuendeArchive/IdentityServer4

DuendeArchive/IdentityServer4

identityserver.io

Releases100

Frequency2 weeks 5 days

Last Release over 5 years ago

Stars61

OpenID Connect and OAuth 2.0 Framework for ASP.NET Core

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2019-12250 ↗	May 21, 2019Tuesday, 21 May 2019, 16:29	—	4.3 MEDIUM
IdentityServer IdentityServer4 through 2.4 has stored XSS via the httpContext to the host/Extensions/RequestLoggerMiddleware.cs LogForErrorContext method, which can be triggered by viewing a log. NOTE: the software maintainer disputes that this is a vulnerability because the request logger is not part of IdentityServer but only our development test host
CVE-2018-8899 ↗	Mar 22, 2018Thursday, 22 March 2018, 05:29	—	4.3 MEDIUM
IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations.