CVE-2019-8400
- Source
- https://cve.org/CVERecord?id=CVE-2019-8400
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-8400.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2019-8400
- Aliases
- Downstream
- Related
- Published
- 2019-02-17T06:29:00Z
- Modified
- 2026-08-03T02:12:54Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter.
- Database specific
{ "unresolved_ranges": [ { "cpes": [ "cpe:2.3:a:ory:hydra:0.10.0:alpha10:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.10.0:alpha11:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.10.0:alpha12:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.10.0:alpha13:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.10.0:alpha14:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.10.0:alpha15:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.10.0:alpha16:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.10.0:alpha17:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.10.0:alpha18:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.10.0:alpha19:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.10.0:alpha1:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.10.0:alpha20:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.10.0:alpha21:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.10.0:alpha2:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.10.0:alpha3:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.10.0:alpha4:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.10.0:alpha5:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.10.0:alpha6:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.10.0:alpha7:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.10.0:alpha8:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.10.0:alpha9:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.1:beta2:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.1:beta3:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.1:beta4:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.4.2:alpha1:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.4.2:alpha2:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.4.2:alpha3:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:0.4.2:alpha4:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:1.0.0:beta1:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:1.0.0:beta2:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:1.0.0:beta3:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:1.0.0:beta4:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:1.0.0:beta5:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:1.0.0:beta6:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:1.0.0:beta7:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:1.0.0:beta8:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:1.0.0:beta9:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:1.0.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:ory:hydra:1.0.0:rc2:*:*:*:*:*:*" ], "extracted_events": [ { "last_affected": "0.1-beta2" }, { "last_affected": "0.1-beta3" }, { "last_affected": "0.1-beta4" }, { "last_affected": "0.4.2-alpha1" }, { "last_affected": "0.4.2-alpha2" }, { "last_affected": "0.4.2-alpha3" }, { "last_affected": "0.4.2-alpha4" }, { "last_affected": "0.10.0-alpha1" }, { "last_affected": "0.10.0-alpha10" }, { "last_affected": "0.10.0-alpha11" }, { "last_affected": "0.10.0-alpha12" }, { "last_affected": "0.10.0-alpha13" }, { "last_affected": "0.10.0-alpha14" }, { "last_affected": "0.10.0-alpha15" }, { "last_affected": "0.10.0-alpha16" }, { "last_affected": "0.10.0-alpha17" }, { "last_affected": "0.10.0-alpha18" }, { "last_affected": "0.10.0-alpha19" }, { "last_affected": "0.10.0-alpha2" }, { "last_affected": "0.10.0-alpha20" }, { "last_affected": "0.10.0-alpha21" }, { "last_affected": "0.10.0-alpha3" }, { "last_affected": "0.10.0-alpha4" }, { "last_affected": "0.10.0-alpha5" }, { "last_affected": "0.10.0-alpha6" }, { "last_affected": "0.10.0-alpha7" }, { "last_affected": "0.10.0-alpha8" }, { "last_affected": "0.10.0-alpha9" }, { "last_affected": "1.0.0-beta1" }, { "last_affected": "1.0.0-beta2" }, { "last_affected": "1.0.0-beta3" }, { "last_affected": "1.0.0-beta4" }, { "last_affected": "1.0.0-beta5" }, { "last_affected": "1.0.0-beta6" }, { "last_affected": "1.0.0-beta7" }, { "last_affected": "1.0.0-beta8" }, { "last_affected": "1.0.0-beta9" }, { "last_affected": "1.0.0-rc1" }, { "last_affected": "1.0.0-rc2" } ], "source": "CPE_FIELD", "vendor_product": "ory:hydra" } ] }- References
-
- https://drive.google.com/file/d/1-25expUYVfK6vsiCmEabUCuelOP7aUDj/view?usp=drivesdk
- https://github.com/ory/hydra/blob/master/CHANGELOG.md#v100-rc3oryos9-2018-12-06
- https://hackerone.com/reports/456333
- https://github.com/ory/hydra/commit/9b5bbd48a72096930af08402c5e07fce7dd770f3
- https://www.youtube.com/watch?v=RIyZLeKEC8E