CVE-2020-5497

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized. This is related to header.tag. The issue can be exploited to execute arbitrary JavaScript.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 4, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-54999.8Baidu Rust SGX SDK through 1.0.8 has an enclave ID race. There are non-deterministic results in which, sometimes, two global IDs are the sam CVE-2020-55014.3phpBB 3.2.8 allows a CSRF attack that can modify a group avatar.CVE-2020-55026.5phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.CVE-2020-55048.8In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in CVE-2020-55059.8Freelancy v1.0.0 allows remote command execution via the "file":"data:application/x-php;base64 substring (in conjunction with "type":"applic CVE-2020-55097.2PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile image.CVE-2020-55109.8PHPGurukul Hostel Management System v2.0 allows SQL injection via the id parameter in the full-profile.php file.CVE-2020-55118.8PHPGurukul Small CRM v2.0 was found vulnerable to authentication bypass via SQL injection when logging into the administrator login page.CVE-2020-55126.8Gila CMS 1.11.8 allows /admin/media?path=../ Path Traversal.CVE-2020-55136.8Gila CMS 1.11.8 allows /cm/delete?t=../ Directory Traversal.CVE-2020-55149.1Gila CMS 1.11.8 allows Unrestricted Upload of a File with a Dangerous Type via .phar or .phtml to the lzld/thumb?src= URI.CVE-2020-55157.2Gila CMS 1.11.8 allows /admin/sql?query= SQL Injection.