CVE-2024-5962
Last modified
CVE-2024-5962 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoint of multiple WSO2 products due to missing output encoding of user-supplied input. A malicious actor can exploit this vulnerability to inject arbitrary JavaScript into the authentication flow, potentially leading to UI modifications, redirections to malicious websites, or data exfiltration from the browser. While this issue could allow an attacker to manipulate the user’s browser, session-related sensitive cookies remain protected with the httpOnly flag, preventing session hijacking.. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoint of multiple WSO2 products due to missing output encoding of user-supplied input. A malicious actor can exploit this vulnerability to inject arbitrary JavaScript into the authentication flow, potentially leading to UI modifications, redirections to malicious websites, or data exfiltration from the browser. While this issue could allow an attacker to manipulate the user’s browser, session-related sensitive cookies remain protected with the httpOnly flag, preventing session hijacking.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Wso2 | Api Manager | 4.2.0 |
| Wso2 | Api Manager | 4.3.0 |
| Wso2 | Identity Server | 6.0.0 |
| Wso2 | Identity Server | 6.1.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-5962?
How severe is CVE-2024-5962?
How do I fix CVE-2024-5962?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-5956This vulnerability allows unauthenticated remote attackers t…5.3
- CVE-2024-5957This vulnerability allows unauthenticated remote attackers t…7.5
- CVE-2024-5958Improper Neutralization of Special Elements used in an SQL C…8.8
- CVE-2024-5959Improper Neutralization of Input During Web Page Generation …5.4
- CVE-2024-5960Plaintext Storage of a Password vulnerability in Eliz Softwa…9.8
- CVE-2024-5961Improper neutralization of input during web page generation …5.3
- CVE-2024-5963Unquoted Executable Path vulnerability in Hitachi Device Man…6.7
- CVE-2024-5964The Zenon Lite theme for WordPress is vulnerable to Stored C…6.4
- CVE-2024-5965The Mosaic theme for WordPress is vulnerable to Stored Cross…5.4
- CVE-2024-5966The Grey Opaque theme for WordPress is vulnerable to Stored …5.4
- CVE-2024-5967A vulnerability was found in Keycloak. The LDAP testing endp…2.7
- CVE-2024-5968The Photo Gallery by 10Web WordPress plugin before 1.8.28 d…4.8
Are you affected by CVE-2024-5962?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST