CVE-2020-24705
Last modified
CVE-2020-24705 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim submits a crafted Try It request, aka Session Hijacking. EPSS estimates a 1.05% chance of exploitation in the next 30 days.
Description
An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim submits a crafted Try It request, aka Session Hijacking. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10.0, Identity Server Analytics through 5.6.0, and IoT Server 3.1.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Wso2 | Api Manager | <= 3.1.0 |
| Wso2 | Api Manager Analytics | 2.5.0 |
| Wso2 | Identity Server | <= 5.10.0 |
| Wso2 | Identity Server Analytics | <= 5.6.0 |
| Wso2 | Identity Server As Key Manager | <= 5.10.0 |
| Wso2 | Iot Server | 3.1.0 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-24705?
How severe is CVE-2020-24705?
How do I fix CVE-2020-24705?
Are you affected by CVE-2020-24705?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST