CVE-2020-27885

2020-10-2921:15:15

Google

osv.dev

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.6%

JSON

Cross-Site Scripting (XSS) vulnerability on WSO2 API Manager 3.1.0. By exploiting a Cross-site scripting vulnerability the attacker can hijack a logged-in user’s session by stealing cookies which means that a malicious hacker can change the logged-in user’s password and invalidate the session of the victim while the hacker maintains access.

CPENameOperatorVersion
product-apimeq1.10.0-Beta
product-apimeq3.1.0-rc2
product-apimeq2.6.0-rc2
product-apimeq3.1.0-m2
product-apimeq3.0.0-rc1
product-apimeq2.5.0-rc3
product-apimeq2.0.0-rc2
product-apimeq2.1.0-update6
product-apimeq2.5.0-Beta
product-apimeq3.1.0-rc1

Name	Operator	Version
product-apim	eq	1.10.0-Beta
product-apim	eq	3.1.0-rc2
product-apim	eq	2.6.0-rc2
product-apim	eq	3.1.0-m2
product-apim	eq	3.0.0-rc1
product-apim	eq	2.5.0-rc3
product-apim	eq	2.0.0-rc2
product-apim	eq	2.1.0-update6
product-apim	eq	2.5.0-Beta
product-apim	eq	3.1.0-rc1