ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 3.0 | 6.1 | MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| Primary | 2.0 | 4.3 | MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| Hyperlink | Source | Resource |
|---|---|---|
| https://drive.google.com/file/d/1-25expUYVfK6vsiCmEabUCuelOP7aUDj/view?usp=drivesdk | cve@mitre.org | Release Notes Third Party Advisory |
| https://github.com/ory/hydra/blob/master/CHANGELOG.md#v100-rc3oryos9-2018-12-06 | cve@mitre.org | Release Notes Third Party Advisory |
| https://github.com/ory/hydra/commit/9b5bbd48a72096930af08402c5e07fce7dd770f3 | cve@mitre.org | Patch Third Party Advisory |
| https://hackerone.com/reports/456333 | cve@mitre.org | Exploit Issue Tracking Third Party Advisory |
| https://www.youtube.com/watch?v=RIyZLeKEC8E | cve@mitre.org | Exploit Third Party Advisory |