PT-2022-10020 · Symantec · Symantec Layer7 Api Management Oauth Toolkit

Daniil Morozov + 1 · Published 2022-02-18 · Updated 2022-02-28 · CVE-2021-30650

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Symantec Layer7 API Management OAuth Toolkit (OTK) (affected versions not specified)

Description A reflected cross-site scripting (XSS) issue in the OTK allows a remote attacker to craft a malicious URL for the OTK web UI, targeting OTK users with phishing attacks or other social engineering techniques. This enables the injection of malicious code into the OTK web UI client application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-30650

Affected Products

Symantec Layer7 Api Management Oauth Toolkit

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-30650 · Security Note
• https://osv.dev/vulnerability/CVE-2021-30650 · Vendor Advisory
• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/CVE-2021-30650-Layer7-OAuth-Toolkit-OTK-/20170 · Vendor Advisory