VulnerabilityModified
CVE-2020-24706
The Try It tool allows Reflected XSS.
MEDIUM 6.1EPSS 0.79%
Does this matter?
Lower severity and a low EPSS score (0.79%). Track it; it rarely justifies an emergency change on its own.
Description
An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10.0, Identity Server Analytics through 5.6.0, and IoT Server 3.1.0.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.79% probability · 54th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- wso2/api manager · wso2/api manager analytics · wso2/identity server · wso2/identity server analytics · wso2/identity server as key manager · wso2/iot server
- Source
- cve@mitre.org
References
- https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0718Vendor Advisory
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2020/WSO2-2020-0718/
- https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0718Vendor Advisory
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2020/WSO2-2020-0718/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.