CVE-2020-8160: XSS
MendixSSO <= 2.1.1 contains endpoints that make use of the openid handler, which is suffering from a Cross-Site Scripting vulnerability via the URL path. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-8160?
CVE-2020-8160 is a Cross-Site Scripting vulnerability in MendixSSO <= 2.1.1.
How severe is CVE-2020-8160?
CVE-2020-8160 has a severity value of 6.1, which is considered medium severity.
How does CVE-2020-8160 affect MendixSSO?
CVE-2020-8160 affects MendixSSO versions up to and including 2.1.1.
What is the CWE for CVE-2020-8160?
The CWE (Common Weakness Enumeration) for CVE-2020-8160 is CWE-79, which is a vulnerability related to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
How can I fix CVE-2020-8160?
To fix CVE-2020-8160, it is recommended to update MendixSSO to a version higher than 2.1.1 that includes a fix for the Cross-Site Scripting vulnerability.