WSO2 Identity Server和WSO2 IS as Key Manager 跨站脚本漏洞

漏洞信息详情

WSO2 Identity Server（IS）和WSO2 IS as Key Manager都是美国WSO2公司的产品。WSO2 Identity Server是一款身份认证服务器。WSO2 IS as Key Manager是一款密钥管理器。

WSO2 IS 5.9.0及之前版本和WSO2 IS as Key Manager 5.9.0及之前版本中的Management Console Basic Policy Editor用户界面存在跨站脚本漏洞。该漏洞源于WEB应用缺少对客户端数据的正确验证。攻击者可利用该漏洞执行客户端代码。

目前厂商已发布升级补丁以修复漏洞，补丁获取链接：

https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0711

来源:MISC

链接:https://cybersecurityworks.com/zerodays/cve-2020-14445-wso2.html

来源:CONFIRM

链接:https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0711

来源:nvd.nist.gov

链接:https://nvd.nist.gov/vuln/detail/CVE-2020-14445

暂无