CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2020-17453
Medium (6.1) in wso2. EPSS 26% chance of exploitation in the next 30 days.
WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.
Severity
- EPSS
- 26% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- wso2:api_manager
- wso2:api_manager_analytics
- wso2:api_microgateway
- wso2:enterprise_integrator
- wso2:identity_server
- wso2:identity_server_analytics
- wso2:identity_server_as_key_manager
- wso2:micro_integrator
References
- https://github.com/JHHAX/CVE-2020-17453-PoC
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1132/
- https://twitter.com/JacksonHHax/status/1374681422678519813
- https://github.com/JHHAX/CVE-2020-17453-PoC
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1132/