CVE-2017-14651

moderate-risk

Published 2017-09-21

WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.

Do I need to act?

7.6% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.8/10 Medium

NETWORK / LOW complexity

Api Manager

App Manager

Dashboard Server

Enterprise Integrator

Enterprise Mobility Manager

Identity Server

Machine Learner

Application Server

Business Process Server

Business Rules Server

Complex Event Processor

Data Analytics Server

Data Services Server

Governance Registry

Iot Server

Message Broker

Storage Server

Wso2

Exploit https://cybersecurityworks.com/zerodays/cve-2017-14651-wso2.html

Patch https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0265

Exploit https://github.com/cybersecurityworks/Disclosed/issues/15

Exploit https://cybersecurityworks.com/zerodays/cve-2017-14651-wso2.html

Patch https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0265

Exploit https://github.com/cybersecurityworks/Disclosed/issues/15

/ 100

moderate-risk

Severity 19/34 · Moderate

Exploitability 10/34 · Low

Exposure 19/34 · Moderate