Cross-site Scripting (XSS)

2022-05-1006:13:56

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

xss

vulnerability

regular expression

validation

localvarpath

recover function

passwordrecoveryapiv1.java

attacker

inject

execute

malicious javascript

callback urls

redirecting

malicious websites

software

EPSS

0.001

Percentile

36.7%

JSON

org.wso2.carbon.identity.mgt.endpoint.util is vulnerable to cross-site scripting. The vulnerability exists due to the lack of regular expression validation in the localVarPath parameter in the recover function of PasswordRecoveryApiV1.java, allowing an attacker to inject and execute malicious javascript through the callback URLs by redirecting to the malicious websites