WSO2 Identity Server和WSO2 IS as Key Manager 输入验证错误漏洞

漏洞信息详情

WSO2 Identity Server（IS）和WSO2 IS as Key Manager都是美国WSO2公司的产品。WSO2 Identity Server是一款身份认证服务器。WSO2 IS as Key Manager是一款密钥管理器。

WSO2 Identity Server 5.10.0及之前版本和WSO2 IS as Key Manager 5.10.0及之前版本中存在安全漏洞。攻击者可通过构建URL利用该漏洞将用户重定向到任意的外部链接，实施钓鱼攻击。

目前厂商已发布升级补丁以修复漏洞，补丁获取链接：

https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0713

来源:MISC

链接:https://cybersecurityworks.com/zerodays/cve-2020-14446-wso2.html

来源:CONFIRM

链接:https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0713

来源:nvd.nist.gov

链接:https://nvd.nist.gov/vuln/detail/CVE-2020-14446

暂无