{"id":"CVE-2020-5497","url":"https://www.cyber-defence.io/tools/cve/CVE-2020-5497","generatedAt":"2026-10-27T22:26:31.313Z","title":"The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized.","description":"The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized. This is related to header.tag. The issue can be exploited to execute arbitrary JavaScript.","published":"2020-01-04T03:15:11.000Z","lastModified":"2026-06-17T03:21:30.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-79"],"affected":["mitreid/connect"],"epss":{"score":0.02133,"percentile":0.81867,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (2.13%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"http://packetstormsecurity.com/files/156574/MITREid-1.3.3-Cross-Site-Scripting.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"http://seclists.org/fulldisclosure/2020/Feb/25","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/1521","tags":["Exploit","Issue Tracking","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.securitymetrics.com/blog/MITREid-Connect-cross-site-scripting-CVE-2020-5497","tags":["Exploit","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://packetstormsecurity.com/files/156574/MITREid-1.3.3-Cross-Site-Scripting.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2020/Feb/25","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/1521","tags":["Exploit","Issue Tracking","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.securitymetrics.com/blog/MITREid-Connect-cross-site-scripting-CVE-2020-5497","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-5497","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}