Vulnerability · Published Jan 6, 2021 · Assigned by hackerone
CVE-2020-8160
Medium 6.1
In plain English
A medium-severity cross-site scripting in MendixSSO. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)0.7%top 45.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
MendixSSO <= 2.1.1 contains endpoints that make use of the openid handler, which is suffering from a Cross-Site Scripting vulnerability via the URL path. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser.
Affected products (as reported)
Weakness: CWE-79
References
- https://hackerone.com/reports/838178 x_refsource_MISC
- https://marketplace.mendix.com/link/component/111349 x_refsource_MISC