Cross-site Scripting (XSS)

2022-05-1007:48:26

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

44.6%

JSON

org.wso2.carbon.identity.application.authentication.framework is vulnerable to cross-site scripting. An attacker can inject and execute malicious javascript through the authenticationEndpointURL parameter in readAuthenticationEndpointURL function of FileBasedConfigurationBuilder.java

CPENameOperatorVersion
wso2 carbon - identity application authentication frameworkle5.20.324
wso2 carbon - identity application authentication frameworkle5.18.244
wso2 carbon - identity application authentication frameworkle5.19.58
wso2 carbon - identity application authentication frameworkle5.17.117
wso2 carbon - identity application authentication frameworkle5.20.324
wso2 carbon - identity application authentication frameworkle5.18.244
wso2 carbon - identity application authentication frameworkle5.19.58
wso2 carbon - identity application authentication frameworkle5.17.117

Name	Operator	Version
wso2 carbon - identity application authentication framework	le	5.20.324
wso2 carbon - identity application authentication framework	le	5.18.244
wso2 carbon - identity application authentication framework	le	5.19.58
wso2 carbon - identity application authentication framework	le	5.17.117
wso2 carbon - identity application authentication framework	le	5.20.324
wso2 carbon - identity application authentication framework	le	5.18.244
wso2 carbon - identity application authentication framework	le	5.19.58
wso2 carbon - identity application authentication framework	le	5.17.117

References

www.rodrigofavarini.com.br/cybersecurity/multiple-xss-on-api-manager-3-1-0/

0.001 Low

EPSS

Percentile

44.6%

JSON

Related for VERACODE:35461