Design/Logic Flaw

2020-08-2716:15:00

PRIOn knowledge base

www.prio-n.com

8.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.8%

JSON

An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim submits a crafted Try It request, aka Session Hijacking. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10.0, Identity Server Analytics through 5.6.0, and IoT Server 3.1.0.

CPENameOperatorVersion
api_managerle3.1.0
api_manager_analyticseq2.5.0
identity_serverle5.10.0
identity_server_analyticsle5.6.0
identity_server_as_key_managerle5.10.0
iot_servereq3.1.0

Name	Operator	Version
api_manager	le	3.1.0
api_manager_analytics	eq	2.5.0
identity_server	le	5.10.0
identity_server_analytics	le	5.6.0
identity_server_as_key_manager	le	5.10.0
iot_server	eq	3.1.0