CVE-2024-39694
2 advisories.
NuGet/Duende.IdentityServer CVE-2024-39694: medium 4.7
IdentityServer Open Redirect vulnerability
Action: Upgrade Duende.IdentityServer to 6.0.5 (6.0.x), 6.1.8 (6.1.x), 6.2.5 (6.2.x), 6.3.10 (6.3.x) or 7.0.6 (7.0.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 7.0.0-preview.1 | 7.0.6 | - |
| 6.3.0-preview.1 | 6.3.10 | - |
| 6.2.0-preview.1 | 6.2.5 | - |
| 6.1.0-preview.1 | 6.1.8 | - |
| 6.0.0-preview.1 | 6.0.5 | - |
Fixed versions
| 7.0.6 | 6.3.10 | 6.2.5 | 6.1.8 | 6.0.5 |
Sources
- osv: GHSA-ff4q-64jc-gx98
- https://github.com/DuendeSoftware/IdentityServer/security/advisories/GHSA-ff4q-64jc-gx98
- https://github.com/IdentityServer/IdentityServer4/security/advisories/GHSA-55p7-v223-x366
- https://nvd.nist.gov/vuln/detail/CVE-2024-39694
- https://github.com/DuendeSoftware/IdentityServer/commit/269ca2171fe1e901c87f2f0797bbc7c230db87c6
- https://github.com/DuendeSoftware/IdentityServer/commit/765116a2d4fb0671b6eba015e698533900c61c8e
- https://github.com/DuendeSoftware/IdentityServer/commit/d0d8eab35ad9183b14925496803ed8b36658d0a1
- https://github.com/DuendeSoftware/IdentityServer/commit/f04cf0be859b93f43563f8f812eb92206ad94011
- https://github.com/DuendeSoftware/IdentityServer/commit/fe817b499933d6ed6141b153492d7335c28b184a
- https://github.com/DuendeSoftware/IdentityServer
CVE-2024-39694 · published · modified · JSON
NuGet/IdentityServer4 CVE-2024-39694: medium 4.7
IdentityServer Open Redirect vulnerability
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 4.1.2 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-ff4q-64jc-gx98#NuGet/IdentityServer4
- https://github.com/DuendeSoftware/IdentityServer/security/advisories/GHSA-ff4q-64jc-gx98
- https://github.com/IdentityServer/IdentityServer4/security/advisories/GHSA-55p7-v223-x366
- https://nvd.nist.gov/vuln/detail/CVE-2024-39694
- https://github.com/DuendeSoftware/IdentityServer/commit/269ca2171fe1e901c87f2f0797bbc7c230db87c6
- https://github.com/DuendeSoftware/IdentityServer/commit/765116a2d4fb0671b6eba015e698533900c61c8e
- https://github.com/DuendeSoftware/IdentityServer/commit/d0d8eab35ad9183b14925496803ed8b36658d0a1
- https://github.com/DuendeSoftware/IdentityServer/commit/f04cf0be859b93f43563f8f812eb92206ad94011
- https://github.com/DuendeSoftware/IdentityServer/commit/fe817b499933d6ed6141b153492d7335c28b184a
- https://github.com/DuendeSoftware/IdentityServer
CVE-2024-39694 · published · modified · JSON