CVE-2019-20442

moderate-risk

Published 2020-01-28

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. A potential stored Cross-Site Scripting (XSS) vulnerability in roleToAuthorize has been identified in the registry UI.

Do I need to act?

0.48% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.8/10 Medium

NETWORK / LOW complexity

Affected Products (4)

Api Manager

Enterprise Integrator

Identity Server

Affected Vendors

Wso2

References (6)

Exploit https://cybersecurityworks.com/zerodays/cve-2019-20442-wso2.html

Vendor Advisory https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0636

Issue Tracking https://github.com/cybersecurityworks/Disclosed/issues/25

Exploit https://cybersecurityworks.com/zerodays/cve-2019-20442-wso2.html

Vendor Advisory https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0636

Issue Tracking https://github.com/cybersecurityworks/Disclosed/issues/25

/ 100

moderate-risk

Severity 19/34 · Moderate

Exploitability 2/34 · Minimal

Exposure 10/34 · Low