CVE-2020-24703

Published Aug 27, 2020

Last updated 10 months ago

CVSS high 8.8

Overview

Description: An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim submits a crafted Try It request, aka Session Hijacking. This affects API Manager 2.2.0, API Manager Analytics 2.2.0, API Microgateway 2.2.0, Data Analytics Server 3.2.0, Enterprise Integrator through 6.6.0, IS as Key Manager 5.5.0, Identity Server 5.5.0 and 5.8.0, Identity Server Analytics 5.5.0, and IoT Server 3.3.0 and 3.3.1.
Source: cve@mitre.org
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

CVSS 2.0

Type: Primary
Base score: 6.8
Impact score: 6.4
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:wso2:api_manager:2.2.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6819491F-C6C3-41C1-B27A-0D0B62224977"
          },
          {
            "criteria": "cpe:2.3:a:wso2:api_manager_analytics:2.2.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "ADEAF56C-4583-40A6-826F-01AC86191AD7"
          },
          {
            "criteria": "cpe:2.3:a:wso2:api_microgateway:2.2.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "79CDDE83-4CB6-4DA3-8E96-FCDA4F5C1E93"
          },
          {
            "criteria": "cpe:2.3:a:wso2:data_analytics_server:3.2.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5CCDDFAB-C8FC-41C4-9872-667C442F119B"
          },
          {
            "criteria": "cpe:2.3:a:wso2:enterprise_integrator:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "16E39585-2B28-4631-A62F-27F17DC9AB4A",
            "versionEndIncluding": "6.6.0"
          },
          {
            "criteria": "cpe:2.3:a:wso2:identity_server:5.5.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8DA0050E-D5DD-45E5-9F61-DC1BB060EFF0"
          },
          {
            "criteria": "cpe:2.3:a:wso2:identity_server:5.8.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2B169832-A746-49A6-8E92-06624AA9B13A"
          },
          {
            "criteria": "cpe:2.3:a:wso2:identity_server_analytics:5.5.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "42BFE7A0-A168-4C1E-8725-41DD500C837E"
          },
          {
            "criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:5.5.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E4F0F121-700C-4D30-BAFC-960DCC56F08B"
          },
          {
            "criteria": "cpe:2.3:a:wso2:iot_server:3.3.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FCAD802D-4746-49D2-AC21-7956F46274A7"
          },
          {
            "criteria": "cpe:2.3:a:wso2:iot_server:3.3.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "53EC589C-09C6-440C-AF9A-DD86A23311FE"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

CVSS 2.0

Weaknesses

Social media

Configurations

References