{"action":"Upgrade Duende.IdentityServer to 6.0.5 (6.0.x), 6.1.8 (6.1.x), 6.2.5 (6.2.x), 6.3.10 (6.3.x) or 7.0.6 (7.0.x) or later.","affected":[{"fixed":"7.0.6","introduced":"7.0.0-preview.1"},{"fixed":"6.3.10","introduced":"6.3.0-preview.1"},{"fixed":"6.2.5","introduced":"6.2.0-preview.1"},{"fixed":"6.1.8","introduced":"6.1.0-preview.1"},{"fixed":"6.0.5","introduced":"6.0.0-preview.1"}],"component":"Duende.IdentityServer","cve_ids":["CVE-2024-39694"],"ecosystem":"NuGet","epss":0.00534,"exploited":false,"fixed_versions":["7.0.6","6.3.10","6.2.5","6.1.8","6.0.5"],"ghsa_id":"GHSA-ff4q-64jc-gx98","id":"tcs_01M5N8MBKH6YCTVG9HTZGWCKZY","modified_at":"2024-07-31T20:13:36.853973Z","published_at":"2024-07-31T15:28:54Z","references":["https://osv.dev/vulnerability/GHSA-ff4q-64jc-gx98","https://github.com/DuendeSoftware/IdentityServer/security/advisories/GHSA-ff4q-64jc-gx98","https://github.com/IdentityServer/IdentityServer4/security/advisories/GHSA-55p7-v223-x366","https://nvd.nist.gov/vuln/detail/CVE-2024-39694","https://github.com/DuendeSoftware/IdentityServer/commit/269ca2171fe1e901c87f2f0797bbc7c230db87c6","https://github.com/DuendeSoftware/IdentityServer/commit/765116a2d4fb0671b6eba015e698533900c61c8e","https://github.com/DuendeSoftware/IdentityServer/commit/d0d8eab35ad9183b14925496803ed8b36658d0a1","https://github.com/DuendeSoftware/IdentityServer/commit/f04cf0be859b93f43563f8f812eb92206ad94011","https://github.com/DuendeSoftware/IdentityServer/commit/fe817b499933d6ed6141b153492d7335c28b184a","https://github.com/DuendeSoftware/IdentityServer"],"severity":{"label":"medium","score":4.7},"sources":[{"source":"osv","source_id":"GHSA-ff4q-64jc-gx98","url":"https://osv.dev/vulnerability/GHSA-ff4q-64jc-gx98"}],"summary":"IdentityServer Open Redirect vulnerability"}