XSS in Wso2 API Manager
CVE-2021-36760
In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL that precedes the callback parameter. Once the username or password reset procedure is completed, the JavaScript code will be executed. (recoverpassword.do also has an open redirect issue for a similar reason.)
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.007 (51.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Wso2 Api_manager — versions 3.0.0, 3.1.0, 3.2.0
- Wso2 Identity_server — versions 5.7.0, 5.8.0, 5.9.0
- Wso2 Identity_server_as_key_manager — versions 5.3.0, 5.5.0, 5.6.0
- Wso2 Iot_server — versions 3.3.1
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (x_refsource_MISC, Vendor Advisory)
- cve@mitre.org (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-36760?
- CVE-2021-36760 is a medium-severity vulnerability in Wso2 API Manager, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2021-12-07.
- How severe is CVE-2021-36760?
- Medium severity. CVSS v3 base score is 6.1 out of 10.
- Is CVE-2021-36760 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.