{"id":"CVE-2020-24704","url":"https://www.cyber-defence.io/tools/cve/CVE-2020-24704","generatedAt":"2026-10-28T04:17:33.542Z","title":"The Try It tool allows Reflected XSS.","description":"An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager 2.2.0, API Manager Analytics 2.2.0, API Microgateway 2.2.0, Data Analytics Server 3.2.0, Enterprise Integrator through 6.6.0, IS as Key Manager 5.5.0, Identity Server 5.5.0 and 5.8.0, Identity Server Analytics 5.5.0, and IoT Server 3.3.0 and 3.3.1.","published":"2020-08-27T16:15:12.000Z","lastModified":"2026-06-17T03:06:00.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-79"],"affected":["wso2/api manager","wso2/api manager analytics","wso2/api microgateway","wso2/data analytics server","wso2/enterprise integrator","wso2/identity server","wso2/identity server analytics","wso2/identity server as key manager","wso2/iot server"],"epss":{"score":0.00722,"percentile":0.53775,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.72%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2020/WSO2-2020-0685/","source":"cve@mitre.org"},{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2020/WSO2-2020-0685/","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-24704","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}