description: MendixSSO <= 2.1.1 contains endpoints that make use of the openid handler, which is suffering from a Cross-Site Scripting vulnerability via the URL path. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser.
problem types: Cross-site Scripting (XSS) - Reflected (CWE-79)
affected:
{
product: MendixSSO
vendor: n/a
versions:
status: affected, version: 2.1.1 and lower
}