Lucene search

GoogleOSV:CVE-2023-31664

HistoryMay 23, 2023 - 1:15 a.m.

CVE-2023-31664

2023-05-2301:15:09

Google

osv.dev

wso2

api manager

vulnerability

xss

authentication endpoint

web scripts

html

tenantdomain

security

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.0%

JSON

A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do of WSO2 API Manager before 4.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tenantDomain parameter.

CPENameOperatorVersion
product-apimeq2.1.0-update14
product-apimeq4.1.0-m2
product-apimeq2.0.0-M1
product-apimeq2.2.0-update3
product-apimeq2.1.0-update9
product-apimeq3.0.0
product-apimeq3.0.0-m32
product-apimeq2.6.0-alpha2
product-apimeq1.10.0
product-apimeq2.5.0-rc2

Name	Operator	Version
product-apim	eq	2.1.0-update14
product-apim	eq	4.1.0-m2
product-apim	eq	2.0.0-M1
product-apim	eq	2.2.0-update3
product-apim	eq	2.1.0-update9
product-apim	eq	3.0.0
product-apim	eq	3.0.0-m32
product-apim	eq	2.6.0-alpha2
product-apim	eq	1.10.0
product-apim	eq	2.5.0-rc2

Rows per page:

1-10 of 1241

References

github.com/adilkhan7/CVE-2023-31664

github.com/wso2/api-manager/issues?q=is%3Aissue+is%3Aclosed+label%3AComponent%2FAPIM+closed%3A2022-04-05..2023-03-11

github.com/wso2/product-apim/releases/tag/v4.2.0

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.0%

JSON

Related for OSV:CVE-2023-31664