6.1

CVE-2017-14995

The Management Console in WSO2 Application Server 5.3.0, WSO2 Business Process Server 3.6.0, WSO2 Business Rules Server 2.2.0, WSO2 Complex Event Processor 4.2.0, WSO2 Dashboard Server 2.0.0, WSO2 Data Analytics Server 3.1.0, WSO2 Data Services Server 3.5.1, and WSO2 Machine Learner 1.2.0 is affected by stored XSS.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wso2 ≫ Application Server Version 5.3.0
Wso2 ≫ Business Process Server Version 3.6.0
Wso2 ≫ Business Rules Server Version 2.2.0
Wso2 ≫ Complex Event Processor Version 4.2.0
Wso2 ≫ Dashboard Server Version 2.0.0
Wso2 ≫ Data Analytics Server Version 3.1.0
Wso2 ≫ Data Services Server Version 3.5.1
Wso2 ≫ Machine Learner Version 1.2.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.64% 0.456
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.1 2.8 2.7
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0257
Patch
Vendor Advisory