Session Hijacking Vulnerability in WSO2 API Manager and Other Products
CVE-2020-24703

8.8HIGH

Key Information:

Vendor

Wso2

Status
Identity Server
Enterprise Integrator
Api Microgateway
Api Manager Analytics
Vendor
CVE Published:
27 August 2020

What is CVE-2020-24703?

An issue was discovered in certain WSO2 products, where a valid Carbon Management Console session cookie may be inadvertently transmitted to an attacker-controlled server. This occurs when a victim submits a crafted 'Try It' request, allowing an attacker to hijack the session. The vulnerability impacts several WSO2 products, potentially exposing sensitive information and compromising the integrity of user sessions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://security.docs.wso2.com/en/latest/security-announc...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.