CVE-2020-24706 - OpenCVE

An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10.0, Identity Server Analytics through 5.6.0, and IoT Server 3.1.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:N/C:N/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Wso2	Api Manager Api Manager Analytics Identity Server Identity Server Analytics Identity Server As Key Manager Iot Server

Configuration 1 [-]

OR	cpe:2.3:a:wso2:api_manager::::::::
	cpe:2.3:a:wso2:api_manager_analytics:2.5.0:::::::*
	cpe:2.3:a:wso2:identity_server::::::::
	cpe:2.3:a:wso2:identity_server_analytics::::::::
	cpe:2.3:a:wso2:identity_server_as_key_manager::::::::
	cpe:2.3:a:wso2:iot_server:3.1.0:::::::*

No data.

References

Link	Providers
https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0718
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2020/WSO2-2020-0718/

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2020-08-27T00:00:00

Updated: 2024-08-04T15:19:09.362Z

Reserved: 2020-08-27T00:00:00

Link: CVE-2020-24706

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-08-27T16:15:11.877

Modified: 2024-01-09T06:15:45.800

Link: CVE-2020-24706

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "E2E71049-86F8-479F-8D9D-2D67B2CC6EB4", "versionEndIncluding": "3.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:api_manager_analytics:2.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "04A2A50A-872E-4CC7-BBB7-3E0956176AAC", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "5601E5C8-011F-4FF3-A327-3B2D637EAC79", "versionEndIncluding": "5.10.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:identity_server_analytics:*:*:*:*:*:*:*:*", "matchCriteriaId": "05810F17-3BC8-400A-92BF-0D51E3580409", "versionEndIncluding": "5.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "78933A5F-C186-47B9-8EC3-161C4451B719", "versionEndIncluding": "5.10.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:iot_server:3.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "663657FF-9D02-49A2-B988-315D52D7E220", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10.0, Identity Server Analytics through 5.6.0, and IoT Server 3.1.0."}, {"lang": "es", "value": "Se detect\u00f3 un problema en determinados productos WSO2. La herramienta Try It permite un ataque de tipo XSS Reflejado. Esto afecta a API Manager versiones hasta 3.1.0, API Manager Analytics versi\u00f3n 2.5.0, IS as Key Manager versiones hasta 5.10.0, Identity Server versiones hasta 5.10.0, Identity Server Analytics versiones hasta 5.6.0 y IoT Server versi\u00f3n 3.1.0"}], "id": "CVE-2020-24706", "lastModified": "2024-01-09T06:15:45.800", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "cve@mitre.org", "type": "Secondary"}]}, "published": "2020-08-27T16:15:11.877", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0718"}, {"source": "cve@mitre.org", "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2020/WSO2-2020-0718/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}