PT-2021-10086 · Wso2 · Wso2 Management Console

Published 2021-03-29 · Updated 2024-01-11 · CVE-2020-17453

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: WSO2 Management Console versions through 5.10

Description: The issue allows for cross-site scripting (XSS) attacks via the msgId parameter in the carbon/admin/login.jsp page. This can potentially lead to privilege escalation. There have been reports of this issue being exploited in real-world attacks to gain super admin privileges.

Recommendations: For WSO2 Management Console versions through 5.10, consider disabling access to the carbon/admin/login.jsp page until a patch is available. As a temporary workaround, restrict the use of the msgId parameter in this page to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-17453

Affected Products

Wso2 Management Console

References · 12

• 🔥 https://github.com/karthi-the-hacker/CVE-2020-17453 · Exploit
• 🔥 https://github.com/JHHAX/CVE-2020-17453-PoC · Exploit
• 🔥 https://twitter.com/JacksonHHax/status/1374681422678519813 · Exploit
• https://osv.dev/vulnerability/CVE-2020-17453 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-17453 · Security Note
• https://github.com/d35ha/CallObfuscator · Note
• https://t.me/cybersecuritytechnologies/3006 · Telegram Post
• https://t.me/cvenotify/12684 · Telegram Post
• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1132 · Note
• https://t.me/cvenotify/66997 · Telegram Post
• https://t.me/cvenotify/12957 · Telegram Post
• https://t.me/cybersecuritytechnologies/3007 · Telegram Post