Lucene search

[email protected]CVE-2020-24705

HistoryAug 27, 2020 - 4:15 p.m.

CVE-2020-24705

2020-08-2716:15:11

[email protected]

web.nvd.nist.gov

cve-2020-24705

wso2

session hijacking

security vulnerability

api manager

identity server

iot server

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.8%

JSON

An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim submits a crafted Try It request, aka Session Hijacking. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10.0, Identity Server Analytics through 5.6.0, and IoT Server 3.1.0.

Affected configurations

NVD

Node

wso2api_managerRange≤3.1.0

wso2api_manager_analyticsMatch2.5.0

wso2identity_serverRange≤5.10.0

wso2identity_server_analyticsRange≤5.6.0

wso2identity_server_as_key_managerRange≤5.10.0

wso2iot_serverMatch3.1.0

CPENameOperatorVersion
wso2:api_managerwso2 api managerle3.1.0
wso2:api_manager_analyticswso2 api manager analyticseq2.5.0
wso2:identity_serverwso2 identity serverle5.10.0
wso2:identity_server_analyticswso2 identity server analyticsle5.6.0
wso2:identity_server_as_key_managerwso2 identity server as key managerle5.10.0
wso2:iot_serverwso2 iot servereq3.1.0

CPE	Name	Operator	Version
wso2:api_manager	wso2 api manager	le	3.1.0
wso2:api_manager_analytics	wso2 api manager analytics	eq	2.5.0
wso2:identity_server	wso2 identity server	le	5.10.0
wso2:identity_server_analytics	wso2 identity server analytics	le	5.6.0
wso2:identity_server_as_key_manager	wso2 identity server as key manager	le	5.10.0
wso2:iot_server	wso2 iot server	eq	3.1.0

References

security.docs.wso2.com/en/latest/security-announcements/security-advisories/2020/WSO2-2020-0718/

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.8%

JSON

Related for CVE-2020-24705

osv1 cvelist1 prion1 veracode1 nvd1