VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Aug 8, 2017· Updated Jun 17, 2026

CVE-2017-12677

CVE-2017-12677

Description

IdentityServer3 2.4.x, 2.5.x, and 2.6.x before 2.6.1 has XSS in an Angular expression on the authorize response page, which might allow remote attackers to obtain sensitive information about the IdentityServer authorization response.

Affected products

7
  • Identityserver/Identityserver37 versions
    cpe:2.3:a:identityserver:identityserver3:2.4.0:*:*:*:*:*:*:*+ 6 more
    • cpe:2.3:a:identityserver:identityserver3:2.4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:identityserver:identityserver3:2.5.0:*:*:*:*:*:*:*
    • cpe:2.3:a:identityserver:identityserver3:2.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:identityserver:identityserver3:2.5.2:*:*:*:*:*:*:*
    • cpe:2.3:a:identityserver:identityserver3:2.5.3:*:*:*:*:*:*:*
    • cpe:2.3:a:identityserver:identityserver3:2.6.0:*:*:*:*:*:*:*
    • (no CPE)range: <2.6.1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.