جزئیات آسیب‌پذیری
CVE-2024-7075
WSO2 API ManagerWSO2 Carbon User Management UIWSO2 Enterprise IntegratorWSO2 Identity Server
Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 Products
CVSS 3.1
4.6متوسط
نمای کلی
اکسپلویت‌های عمومی
اخبار مرتبط
خط زمانی
خلاصه‌ی فارسی
خلاصه‌ی فارسی برای این آسیب‌پذیری هنوز تهیه نشده است.
شرح رسمی (انگلیسی)
The user search function within the management console fails to properly encode user-supplied input before rendering it in the browser. This allows an attacker to inject malicious scripts that are then executed by the user's browser in the context of the management console. Successful exploitation enables an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract information from the browser. However, due to the use of the httpOnly flag on sensitive session cookies, session hijacking or similar attacks are prevented.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 4.6متوسط | 3.1 | CVEProject cvelistV5 (CNA) (WSO2) | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| WSO2 | WSO2 API Manager | v < 3.2.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 3.2.0 ≤ v < 3.2.0.388 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 3.2.1 ≤ v < 3.2.1.31 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.0.0 ≤ v < 4.0.0.325 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.1.0 ≤ v < 4.1.0.186 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.2.0 ≤ v < 4.2.0.125 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.3.0 ≤ v < 4.3.0.36 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.4.0 ≤ v < 4.4.0.2 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon User Management UI | 5.14.127 ≤ v < 5.14.127.12 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon User Management UI | 5.17.118 ≤ v < 5.17.118.12 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon User Management UI | 5.18.187 ≤ v < 5.18.187.282 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon User Management UI | 5.18.187 ≤ v < 5.18.187.266 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon User Management UI | 5.18.248 ≤ v < 5.18.248.24 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon User Management UI | 5.23.8 ≤ v < 5.23.8.185 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon User Management UI | 5.24.8 ≤ v < 5.24.8.13 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon User Management UI | 5.25.705 ≤ v < 5.25.705.13 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon User Management UI | 5.25.713 ≤ v < 5.25.713.3 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon User Management UI | 5.25.92 ≤ v < 5.25.92.93 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon User Management UI | 7.0.78 ≤ v < 7.0.78.34 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Enterprise Integrator | v < 6.6.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Enterprise Integrator | 6.6.0 ≤ v < 6.6.0.212 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | v < 5.11.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 5.11.0 ≤ v < 5.11.0.364 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 6.0.0 ≤ v < 6.0.0.208 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 6.1.0 ≤ v < 6.1.0.187 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 7.0.0 ≤ v < 7.0.0.60 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۱اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۸/۱۱
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۸/۱۱
- وضعیت
- PUBLISHED
- صادرکننده (CNA)
- WSO2
- اولویت کلون
- به‌زودی
پیش‌بینی بهره‌برداری (EPSS)
۰٫۱۸٪
احتمال بهره‌برداری در ۳۰ روز
۸٫۵٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- Automatable
- no
- Exploitation
- none
- Technical Impact
- partial
ضعف‌ها (CWE)
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')