CVSS 3.0
5.4 mediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NCVE-2018-20737
Medium (5.4) in wso2. EPSS 1.0% chance of exploitation in the next 30 days.
An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. Reflected XSS exists in the carbon part of the product.
Severity
- EPSS
- 1.0% chance of exploitation in the next 30 days; higher than 62% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- wso2:api_manager
- wso2:identity_server
- wso2:identity_server_as_key_manager
References
- https://github.com/wso2-extensions/identity-inbound-auth-oauth/pull/978/files
- https://wso2.com/security-patch-releases/api-manager
- https://www.excellium-services.com/cert-xlm-advisory/cve-2018-20737/
- https://github.com/wso2-extensions/identity-inbound-auth-oauth/pull/978/files
- https://wso2.com/security-patch-releases/api-manager