PT-2020-14005 · Wso2 · Wso2 Is As Key Manager+1

Published 2020-06-18 · Updated 2022-11-16 · CVE-2020-14445

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WSO2 Identity Server versions through 5.9.0 WSO2 IS as Key Manager versions through 5.9.0

Description A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console Basic Policy Editor user Interface. This issue affects the Management Console's Basic Policy Editor, potentially allowing for reflected cross-site scripting attacks.

Recommendations For WSO2 Identity Server versions through 5.9.0, consider disabling access to the Management Console Basic Policy Editor until a fix is available. For WSO2 IS as Key Manager versions through 5.9.0, restrict access to the Management Console Basic Policy Editor to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-14445

Affected Products

Wso2 Is As Key Manager

Wso2 Identity Server

References · 5

• 🔥 https://cybersecurityworks.com/zerodays/cve-2020-14445-wso2.html · Exploit
• https://osv.dev/vulnerability/CVE-2020-14445 · Vendor Advisory
• https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0711 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14445 · Security Note
• https://t.me/cvenotify/4491 · Telegram Post