Mitreid

3 CVEs vendor

Monthly

Sort: Newest CVSS Score EPSS Score Oldest

CVE-2021-26715 Mar 25, 09:15 Maven CRITICAL POC Act Now

The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

XSS Information Disclosure SSRF Connect Mitreid

NVD GitHub

CVSS 3.1

9.1

EPSS

1.5%

CVE-2021-27582 Feb 23, 18:15 Maven CRITICAL POC PATCH Act Now

org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment (aka Autobinding) vulnerability. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Java Information Disclosure Prototype Pollution Connect Mitreid

NVD GitHub

CVSS 3.1

9.1

EPSS

2.2%

CVE-2020-5497 Jan 04, 03:15 Maven MEDIUM POC This Month

The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

XSS Connect Mitreid

NVD GitHub

CVSS 3.1

6.1

EPSS

2.1%

CVE-2021-26715 Maven

EPSS 1% CVSS 9.1

CRITICAL POC Act Now

XSS Information Disclosure SSRF +2

NVD GitHub

CVE-2021-27582 Maven

EPSS 2% CVSS 9.1

CRITICAL POC PATCH Act Now

Java Information Disclosure Prototype Pollution +2

NVD GitHub

CVE-2020-5497 Maven

EPSS 2% CVSS 6.1

MEDIUM POC This Month

XSS Connect Mitreid

NVD GitHub