Lucene search

[email protected]CVE-2017-14651

HistorySep 21, 2017 - 6:29 p.m.

CVE-2017-14651

2017-09-2118:29:00

CWE-79

[email protected]

web.nvd.nist.gov

wso2

data analytics server

xss

vulnerability

add_collection_ajaxprocessor.jsp

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.4%

JSON

WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.

Affected configurations

NVD

Node

wso2api_managerMatch2.1.0

wso2app_managerMatch1.2.0

wso2application_serverMatch5.3.0

wso2business_process_serverMatch3.6.0

wso2business_rules_serverMatch2.2.0

wso2complex_event_processorMatch4.2.0

wso2dashboard_serverMatch2.0.0

wso2data_analytics_serverMatch3.1.0

wso2data_services_serverMatch3.5.1

wso2enterprise_integratorMatch6.1.1

wso2enterprise_mobility_managerMatch2.2.0

wso2governance_registryMatch5.4.0

wso2identity_serverMatch5.3.0

wso2iot_serverMatch3.0.0

wso2machine_learnerMatch1.2.0

wso2message_brokerMatch3.2.0

wso2storage_serverMatch1.5.0

CPENameOperatorVersion
wso2:api_managerwso2 api managereq2.1.0
wso2:app_managerwso2 app managereq1.2.0
wso2:application_serverwso2 application servereq5.3.0
wso2:business_process_serverwso2 business process servereq3.6.0
wso2:business_rules_serverwso2 business rules servereq2.2.0
wso2:complex_event_processorwso2 complex event processoreq4.2.0
wso2:dashboard_serverwso2 dashboard servereq2.0.0
wso2:data_analytics_serverwso2 data analytics servereq3.1.0
wso2:data_services_serverwso2 data services servereq3.5.1
wso2:enterprise_integratorwso2 enterprise integratoreq6.1.1

CPE	Name	Operator	Version
wso2:api_manager	wso2 api manager	eq	2.1.0
wso2:app_manager	wso2 app manager	eq	1.2.0
wso2:application_server	wso2 application server	eq	5.3.0
wso2:business_process_server	wso2 business process server	eq	3.6.0
wso2:business_rules_server	wso2 business rules server	eq	2.2.0
wso2:complex_event_processor	wso2 complex event processor	eq	4.2.0
wso2:dashboard_server	wso2 dashboard server	eq	2.0.0
wso2:data_analytics_server	wso2 data analytics server	eq	3.1.0
wso2:data_services_server	wso2 data services server	eq	3.5.1
wso2:enterprise_integrator	wso2 enterprise integrator	eq	6.1.1

Rows per page:

1-10 of 171

References

cybersecurityworks.com/zerodays/cve-2017-14651-wso2.html

docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0265

github.com/cybersecurityworks/Disclosed/issues/15

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.4%

JSON

Related for CVE-2017-14651

hackerone1 openvas7 nuclei1 nvd1 prion1 osv1 cvelist1