CVE-2020-24706

Published: Aug 27, 2020Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10.0, Identity Server Analytics through 5.6.0, and IoT Server 3.1.0.

Affected (6)

Products: Wso2: Api Manager, Api Manager Analytics, Identity Server, Identity Server Analytics, Identity Server As Key Manager, Iot Server

Wso2

6 products

Api Manager

Api Manager Analytics

Identity Server

Identity Server Analytics

Identity Server As Key Manager

Iot Server

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Wso2 Api Manager	Up to 3.1.0
Wso2 Api Manager Analytics	Version 2.5.0
Wso2 Identity Server	Up to 5.10.0
Wso2 Identity Server Analytics	Up to 5.6.0
Wso2 Identity Server As Key Manager	Up to 5.10.0
Wso2 Iot Server	Version 3.1.0

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0718

Source: cve@mitre.org

Vendor Advisory

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2020/WSO2-2020-0718/

Source: cve@mitre.org

https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0718

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2020/WSO2-2020-0718/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.