← Back

CVE-2020-17453

nvd nistnuclei
Published: Apr 5, 2021Modified: Jun 17, 2026

JSON object

Loading...
6.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.7
Source: NVD

Description

WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.

Affected (17)

Wso2
8 products
Api Manager
Api Manager Analytics
Api Microgateway
Enterprise Integrator
Identity Server
Identity Server Analytics
Identity Server As Key Manager
Micro Integrator
Configuration A
17 vulnerable
Vulnerable SoftwareAffected Versions
Api Manager
Up to 3.2.0
Wso2
Api Manager Analytics
Version 2.2.0
Api Manager Analytics
Version 2.5.0
Api Manager Analytics
Version 2.6.0
Api Microgateway
Version 2.2.0
Enterprise Integrator
Up to 6.6.0
Identity Server
Up to 5.10.0
Wso2
Identity Server Analytics
Version 5.4.0
Identity Server Analytics
Version 5.4.1
Identity Server Analytics
Version 5.5.0
Identity Server Analytics
Version 5.6.0
Wso2
Identity Server As Key Manager
Version 5.10.0
Identity Server As Key Manager
Version 5.5.0
Identity Server As Key Manager
Version 5.6.0
Identity Server As Key Manager
Version 5.7.0
Identity Server As Key Manager
Version 5.9.0
Micro Integrator
Version 1.0.0

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (6)

Source: cve@mitre.org
ExploitThird Party Advisory
Source: cve@mitre.org
Source: cve@mitre.org
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory

Timeline

No history available yet.