CVSS 3.1
4.8 mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NCVE-2017-14651
WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.
Severity
- EPSS
- 3.8% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- wso2:api_manager
- wso2:app_manager
- wso2:application_server
- wso2:business_process_server
- wso2:business_rules_server
- wso2:complex_event_processor
- wso2:dashboard_server
- wso2:data_analytics_server
- wso2:data_services_server
- wso2:enterprise_integrator
- wso2:enterprise_mobility_manager
- wso2:governance_registry
- wso2:identity_server
- wso2:iot_server
- wso2:machine_learner
- wso2:message_broker
- wso2:storage_server
References
- https://cybersecurityworks.com/zerodays/cve-2017-14651-wso2.html
- https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0265
- https://github.com/cybersecurityworks/Disclosed/issues/15
- https://cybersecurityworks.com/zerodays/cve-2017-14651-wso2.html
- https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0265