CVE-2019-8400: XSS

Published Feb 17, 2019

Updated

ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error errorhint parameter.

Affected Software

129 affected components

Ory Hydra=0.1-beta1

Ory Hydra=0.1-beta2

Ory Hydra=0.1-beta3

Ory Hydra=0.1-beta4

Ory Hydra=0.2.0

Ory Hydra=0.3.0

Ory Hydra=0.3.1

Ory Hydra=0.4.0

Ory Hydra=0.4.1

Ory Hydra=0.4.2

Ory Hydra=0.4.2-alpha

Ory Hydra=0.4.2-alpha1

Ory Hydra=0.4.2-alpha2

Ory Hydra=0.4.2-alpha3

Ory Hydra=0.4.2-alpha4

Ory Hydra=0.4.3

Ory Hydra=0.5.0

Ory Hydra=0.5.1

Ory Hydra=0.5.2

Ory Hydra=0.5.3

Ory Hydra=0.5.4

Ory Hydra=0.5.5

Ory Hydra=0.5.6

Ory Hydra=0.5.7

Ory Hydra=0.5.8

Ory Hydra=0.6.0

Ory Hydra=0.6.1

Ory Hydra=0.6.2

Ory Hydra=0.6.3

Ory Hydra=0.6.4

Ory Hydra=0.6.5

Ory Hydra=0.6.6

Ory Hydra=0.6.7

Ory Hydra=0.6.8

Ory Hydra=0.6.9

Ory Hydra=0.6.10

Ory Hydra=0.7.0

Ory Hydra=0.7.1

Ory Hydra=0.7.2

Ory Hydra=0.7.3

Ory Hydra=0.7.4

Ory Hydra=0.7.5

Ory Hydra=0.7.6

Ory Hydra=0.7.7

Ory Hydra=0.7.8

Ory Hydra=0.7.9

Ory Hydra=0.7.10

Ory Hydra=0.7.11

Ory Hydra=0.7.12

Ory Hydra=0.7.13

Ory Hydra=0.8.0

Ory Hydra=0.8.1

Ory Hydra=0.8.2

Ory Hydra=0.8.3

Ory Hydra=0.8.4

Ory Hydra=0.8.5

Ory Hydra=0.8.6

Ory Hydra=0.8.7

Ory Hydra=0.9.0

Ory Hydra=0.9.1

Ory Hydra=0.9.2

Ory Hydra=0.9.3

Ory Hydra=0.9.4

Ory Hydra=0.9.5

Ory Hydra=0.9.6

Ory Hydra=0.9.7

Ory Hydra=0.9.8

Ory Hydra=0.9.9

Ory Hydra=0.9.10

Ory Hydra=0.9.11

Ory Hydra=0.9.12

Ory Hydra=0.9.13

Ory Hydra=0.9.14

Ory Hydra=0.9.15

Ory Hydra=0.9.16

Ory Hydra=0.10.0

Ory Hydra=0.10.0-alpha1

Ory Hydra=0.10.0-alpha10

Ory Hydra=0.10.0-alpha11

Ory Hydra=0.10.0-alpha12

Ory Hydra=0.10.0-alpha13

Ory Hydra=0.10.0-alpha14

Ory Hydra=0.10.0-alpha15

Ory Hydra=0.10.0-alpha16

Ory Hydra=0.10.0-alpha17

Ory Hydra=0.10.0-alpha18

Ory Hydra=0.10.0-alpha19

Ory Hydra=0.10.0-alpha2

Ory Hydra=0.10.0-alpha20

Ory Hydra=0.10.0-alpha21

Ory Hydra=0.10.0-alpha3

Ory Hydra=0.10.0-alpha4

Ory Hydra=0.10.0-alpha5

Ory Hydra=0.10.0-alpha6

Ory Hydra=0.10.0-alpha7

Ory Hydra=0.10.0-alpha8

Ory Hydra=0.10.0-alpha9

Ory Hydra=0.10.1

Ory Hydra=0.10.2

Ory Hydra=0.10.3

Ory Hydra=0.10.4

Ory Hydra=0.10.5

Ory Hydra=0.10.6

Ory Hydra=0.10.7

Ory Hydra=0.10.8

Ory Hydra=0.10.9

Ory Hydra=0.10.10

Ory Hydra=0.11.0

Ory Hydra=0.11.1

Ory Hydra=0.11.2

Ory Hydra=0.11.3

Ory Hydra=0.11.4

Ory Hydra=0.11.6

Ory Hydra=0.11.7

Ory Hydra=0.11.9

Ory Hydra=0.11.10

Ory Hydra=0.11.12

Ory Hydra=0.11.14

Ory Hydra=1.0.0-beta1

Ory Hydra=1.0.0-beta2

Ory Hydra=1.0.0-beta3

Ory Hydra=1.0.0-beta4

Ory Hydra=1.0.0-beta5

Ory Hydra=1.0.0-beta6

Ory Hydra=1.0.0-beta7

Ory Hydra=1.0.0-beta8

Ory Hydra=1.0.0-beta9

Ory Hydra=1.0.0-rc1

Ory Hydra=1.0.0-rc2

Remediation

Patch Available

https://github.com/ory/hydra/commit/9b5bbd48a72096930af08402c5e07fce7dd770f3

Event History

Feb 17, 2019

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

Description

Data Sourced

via NVD·06:29 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2019-8400?

CVE-2019-8400 has a severity rating of Medium due to the risk of reflected cross-site scripting (XSS).

How do I fix CVE-2019-8400?

To fix CVE-2019-8400, upgrade ORY Hydra to version 1.0.0-rc.3 or a later version where the vulnerability has been resolved.

What type of vulnerability is CVE-2019-8400?

CVE-2019-8400 is classified as a Reflected Cross-Site Scripting (XSS) vulnerability involving the error_hint parameter.

What software does CVE-2019-8400 affect?

CVE-2019-8400 affects multiple versions of ORY Hydra, specifically versions before 1.0.0-rc.3.

Can CVE-2019-8400 be exploited?

Yes, CVE-2019-8400 can potentially be exploited by attackers to execute malicious scripts in the context of a user's session.