PT-2020-10447 · Wso2 · Wso2 Is As Key Manager+2

Sathish Kumar Balakrishnan · Published 2020-01-27 · Updated 2022-11-10 · CVE-2019-20436

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WSO2 API Manager version 2.6.0 WSO2 IS as Key Manager version 5.7.0 WSO2 Identity Server version 5.8.0

Description An issue was discovered where if a claim dialect is configured with an XSS payload in the dialect URI, and a user adds this dialect's URI as the service provider claim dialect while configuring the service provider, the payload gets executed. The attacker needs to have privileges to log in to the management console and to add and configure claim dialects.

Recommendations For WSO2 API Manager version 2.6.0, consider disabling the claim dialect configuration feature until a patch is available. For WSO2 IS as Key Manager version 5.7.0, restrict access to the management console to minimize the risk of exploitation. For WSO2 Identity Server version 5.8.0, avoid using the claim dialect URI in the service provider configuration until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-20436

Affected Products

Wso2 Api Manager

Wso2 Is As Key Manager

Wso2 Identity Server

References · 6

• 🔥 https://github.com/cybersecurityworks/Disclosed/issues/19 · Exploit
• 🔥 https://cybersecurityworks.com/zerodays/cve-2019-20436-wso2.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-20436 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20436 · Security Note
• https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0634 · Vendor Advisory
• https://t.me/cvenotify/497 · Telegram Post