CVE-2019-20437

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. When a custom claim dialect with an XSS payload is configured in the identity provider basic claim configuration, that payload gets executed, if a user picks up that dialect's URI as the provisioning claim in the advanced claim configuration of the same Identity Provider. The attacker also needs to have privileges to log in to the management console, and to add and update identity provider configurations.

CVSS v3 6.1 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://cybersecurityworks.com/zerodays/cve-2019-20437-wso2.html	Exploit Third Party Advisory
https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0635	Vendor Advisory
https://github.com/cybersecurityworks/Disclosed/issues/20	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:wso2:api_manager:2.6.0:::::::*
	cpe:2.3:a:wso2:identity_server:5.7.0:::::::*
	cpe:2.3:a:wso2:identity_server:5.8.0:::::::*

History

No history.

Information

Published : 2020-01-28 01:15

Updated : 2024-02-28 17:28

NVD link : CVE-2019-20437

Mitre link : CVE-2019-20437

CVE.ORG link : CVE-2019-20437

JSON object : View

Products Affected

wso2

api_manager
identity_server

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2019-20437", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2020-01-28T01:15:12.037", "references": [{"url": "https://cybersecurityworks.com/zerodays/cve-2019-20437-wso2.html", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0635", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/cybersecurityworks/Disclosed/issues/20", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. When a custom claim dialect with an XSS payload is configured in the identity provider basic claim configuration, that payload gets executed, if a user picks up that dialect's URI as the provisioning claim in the advanced claim configuration of the same Identity Provider. The attacker also needs to have privileges to log in to the management console, and to add and update identity provider configurations."}, {"lang": "es", "value": "Se detect\u00f3 un problema en WSO2 API Manager versi\u00f3n 2.6.0, WSO2 IS as Key Manager versi\u00f3n 5.7.0 y WSO2 Identity Server versi\u00f3n 5.8.0. Cuando un dialecto de reclamo personalizado con una carga \u00fatil de tipo XSS es establecido en la configuraci\u00f3n b\u00e1sica de reclamo del proveedor de identidad, esa carga \u00fatil es ejecutada, si un usuario recoge el URI de ese dialecto como el reclamo de aprovisionamiento en la configuraci\u00f3n de reclamo avanzada del mismo proveedor de identidad. El atacante tambi\u00e9n necesita contar con privilegios para iniciar sesi\u00f3n en la consola de administraci\u00f3n y para agregar y actualizar las configuraciones del proveedor de identidad."}], "lastModified": "2022-11-10T04:48:57.927", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:api_manager:2.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BC168B6A-B15A-4C3B-A38D-C0B65F24F333"}, {"criteria": "cpe:2.3:a:wso2:identity_server:5.7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "60781FE4-38A3-4FEA-9D8B-CADE4B535974"}, {"criteria": "cpe:2.3:a:wso2:identity_server:5.8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2B169832-A746-49A6-8E92-06624AA9B13A"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}