WSO2 API Manager/IS as Key Manager/Identity Server Management Console cross site scripting

Summaryinfo

A vulnerability was found in WSO2 API Manager, IS as Key Manager and Identity Server. It has been rated as problematic. This affects an unknown function of the component Management Console. This manipulation causes cross site scripting. This vulnerability appears as CVE-2019-20436. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in WSO2 API Manager, IS as Key Manager and Identity Server (Automation Software) (version unknown). It has been declared as problematic. Affected by this vulnerability is an unknown function of the component Management Console. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. As an impact it is known to affect integrity. The summary by CVE is:

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. If there is a claim dialect configured with an XSS payload in the dialect URI, and a user picks up this dialect's URI and adds it as the service provider claim dialect while configuring the service provider, that payload gets executed. The attacker also needs to have privileges to log in to the management console, and to add and configure claim dialects.

The weakness was presented 01/28/2020. This vulnerability is known as CVE-2019-20436 since 01/27/2020. The attack can be launched remotely. The successful exploitation requires a single authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-149444 for similar entry. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• WSO2

Name

• API Manager
• Identity Server
• IS as Key Manager

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion