CVE-2017-12677

—

CVSS 3.0

6.1 medium

EPSS

1%p62

Published

Aug 8, 2017 (Aug 8, 2017)

Modified

Jun 17, 2026

Description

IdentityServer3 2.4.x, 2.5.x, and 2.6.x before 2.6.1 has XSS in an Angular expression on the authorize response page, which might allow remote attackers to obtain sensitive information about the IdentityServer authorization response.

Vendors: identityserver
Products: identityserver3
Weakness: CWE-79
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (1.0%)

In the news0 stories

No ingested article mentions this CVE yet.