CVE-2020-17453

Опубликовано: 05 апр. 2021

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Средний

Описание

WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.

Ссылки

https://github.com/JHHAX/CVE-2020-17453-PoC
Exploit
Third Party Advisory
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1132/
https://twitter.com/JacksonHHax/status/1374681422678519813
Exploit
Third Party Advisory
https://github.com/JHHAX/CVE-2020-17453-PoC
Exploit
Third Party Advisory
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1132/
https://twitter.com/JacksonHHax/status/1374681422678519813
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*

Версия до 3.2.0 (включая)

cpe:2.3:a:wso2:api_manager_analytics:2.2.0:*:*:*:*:*:*:*

cpe:2.3:a:wso2:api_manager_analytics:2.5.0:*:*:*:*:*:*:*

cpe:2.3:a:wso2:api_manager_analytics:2.6.0:*:*:*:*:*:*:*

cpe:2.3:a:wso2:api_microgateway:2.2.0:*:*:*:*:*:*:*

cpe:2.3:a:wso2:enterprise_integrator:*:*:*:*:*:*:*:*

Версия до 6.6.0 (включая)

cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*

Версия до 5.10.0 (включая)

cpe:2.3:a:wso2:identity_server_analytics:5.4.0:*:*:*:*:*:*:*

cpe:2.3:a:wso2:identity_server_analytics:5.4.1:*:*:*:*:*:*:*

cpe:2.3:a:wso2:identity_server_analytics:5.5.0:*:*:*:*:*:*:*

cpe:2.3:a:wso2:identity_server_analytics:5.6.0:*:*:*:*:*:*:*

cpe:2.3:a:wso2:identity_server_as_key_manager:5.5.0:*:*:*:*:*:*:*

cpe:2.3:a:wso2:identity_server_as_key_manager:5.6.0:*:*:*:*:*:*:*

cpe:2.3:a:wso2:identity_server_as_key_manager:5.7.0:*:*:*:*:*:*:*

cpe:2.3:a:wso2:identity_server_as_key_manager:5.9.0:*:*:*:*:*:*:*

cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*

cpe:2.3:a:wso2:micro_integrator:1.0.0:*:*:*:*:*:*:*

EPSS

Процентиль: 98%

0.64438

Средний

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-5q6x-p849-7jj8