Lucene search

[email protected]CVE-2020-24706

HistoryAug 27, 2020 - 4:15 p.m.

CVE-2020-24706

2020-08-2716:15:11

CWE-79

[email protected]

web.nvd.nist.gov

wso2

reflected xss

api manager

api manager analytics

identity server

iot server

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

36.3%

JSON

An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10.0, Identity Server Analytics through 5.6.0, and IoT Server 3.1.0.

Affected configurations

NVD

Node

wso2api_managerRange≤3.1.0

wso2api_manager_analyticsMatch2.5.0

wso2identity_serverRange≤5.10.0

wso2identity_server_analyticsRange≤5.6.0

wso2identity_server_as_key_managerRange≤5.10.0

wso2iot_serverMatch3.1.0

CPENameOperatorVersion
wso2:api_managerwso2 api managerle3.1.0
wso2:api_manager_analyticswso2 api manager analyticseq2.5.0
wso2:identity_serverwso2 identity serverle5.10.0
wso2:identity_server_analyticswso2 identity server analyticsle5.6.0
wso2:identity_server_as_key_managerwso2 identity server as key managerle5.10.0
wso2:iot_serverwso2 iot servereq3.1.0

CPE	Name	Operator	Version
wso2:api_manager	wso2 api manager	le	3.1.0
wso2:api_manager_analytics	wso2 api manager analytics	eq	2.5.0
wso2:identity_server	wso2 identity server	le	5.10.0
wso2:identity_server_analytics	wso2 identity server analytics	le	5.6.0
wso2:identity_server_as_key_manager	wso2 identity server as key manager	le	5.10.0
wso2:iot_server	wso2 iot server	eq	3.1.0

References

docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0718

security.docs.wso2.com/en/latest/security-announcements/security-advisories/2020/WSO2-2020-0718/

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

36.3%

JSON

Related for CVE-2020-24706

prion1 veracode1 cvelist1 osv1 nvd1