Lucene search

[email protected]CVE-2020-14445

HistoryJun 18, 2020 - 6:15 p.m.

CVE-2020-14445

2020-06-1818:15:11

CWE-79

[email protected]

web.nvd.nist.gov

cve

2020

14445

reflected xss

wso2 identity server

security vulnerability

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

24.9%

JSON

An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console Basic Policy Editor user Interface.

Affected configurations

NVD

Node

wso2identity_serverRange≤5.9.0

wso2identity_server_as_key_managerRange≤5.9.0

CPENameOperatorVersion
wso2:identity_serverwso2 identity serverle5.9.0
wso2:identity_server_as_key_managerwso2 identity server as key managerle5.9.0

CPE	Name	Operator	Version
wso2:identity_server	wso2 identity server	le	5.9.0
wso2:identity_server_as_key_manager	wso2 identity server as key manager	le	5.9.0

References

cybersecurityworks.com/zerodays/cve-2020-14445-wso2.html

docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0711

Social References

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

24.9%

JSON

Related for CVE-2020-14445

nvd1 prion1 cvelist1