CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
EPSS
Percentile
27.4%
Authentik is an open-source Identity Provider. Authentik is a vulnerable to a reflected Cross-Site Scripting vulnerability via JavaScript-URIs in OpenID Connect flows with response_mode=form_post
. This relatively user could use the described attacks to perform a privilege escalation. This vulnerability has been patched in versions 2023.10.6 and 2023.8.6.
Vendor | Product | Version | CPE |
---|---|---|---|
goauthentik | authentik | * | cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:* |
[
{
"vendor": "goauthentik",
"product": "authentik",
"versions": [
{
"version": "<= 2023.10.5",
"status": "affected"
},
{
"version": "<= 2023.8.5",
"status": "affected"
}
]
}
]