CVE-2020-8160 | BDVDB-2026-146949 Detail

MendixSSO

Description#

MendixSSO <= 2.1.1 contains endpoints that make use of the openid handler, which is suffering from a Cross-Site Scripting vulnerability via the URL path. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References#

https://hackerone.com/reports/838178
https://marketplace.mendix.com/link/component/111349

Exploit#

No public exploit known

History#

Version 12021-01-06Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.