XSS in Wso2 Api_manager
CVE-2020-24706
An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10.0, Identity Server…
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.008 (52.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Wso2 Api_manager
- Wso2 Api_manager_analytics — versions 2.5.0
- Wso2 Identity_server
- Wso2 Identity_server_analytics
- Wso2 Identity_server_as_key_manager
- Wso2 Iot_server — versions 3.1.0
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Vendor Advisory)
- cve@mitre.org
Frequently asked questions
- What is CVE-2020-24706?
- CVE-2020-24706 is a medium-severity vulnerability in Wso2 Api_manager, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2020-08-27.
- How severe is CVE-2020-24706?
- Medium severity. CVSS v3 base score is 6.1 out of 10.
- Is CVE-2020-24706 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.