CVE-2019-20442 - An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0

Back Back to CVE browser

MEDIUM

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0

Published Jan 27, 2020

4.8

MEDIUM

CVSS 3.1

EPSS 0.73%

Description

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. A potential stored Cross-Site Scripting (XSS) vulnerability in roleToAuthorize has been identified in the registry UI.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

https://cybersecurityworks.com/zerodays/cve-2019-20442-wso2.html
x_refsource_MISCExploitThird Party Advisory
https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0636
x_refsource_MISCVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-10990
Advisory
https://github.com/cybersecurityworks/Disclosed/issues/25
x_refsource_MISCIssue TrackingThird Party Advisory

Link	Providers	Tags
https://cybersecurityworks.com/zerodays/cve-2019-20442-wso2.html		x_refsource_MISCExploitThird Party Advisory
https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0636		x_refsource_MISCVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-10990		Advisory
https://github.com/cybersecurityworks/Disclosed/issues/25		x_refsource_MISCIssue TrackingThird Party Advisory