CVE-2017-14651
WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.
- Score
- CVSS 3.1 4.8 Medium
- Status
- Modified - cve@mitre.org
- Published
- 2017-09-21
- Last modified
- 2024-08-05
- Weaknesses
- CWE-79
Affected products
- Api Manager (Wso2)
- App Manager (Wso2)
- Application Server (Wso2)
- Business Process Server (Wso2)
- Business Rules Server (Wso2)
- Complex Event Processor (Wso2)
- Dashboard Server (Wso2)
- Data Analytics Server (Wso2)
- Data Services Server (Wso2)
- Enterprise Integrator (Wso2)
- Enterprise Mobility Manager (Wso2)
- Governance Registry (Wso2)
- Identity Server (Wso2)
- Iot Server (Wso2)
- Machine Learner (Wso2)
- Message Broker (Wso2)
- Storage Server (Wso2)
References
- https://cybersecurityworks.com/zerodays/cve-2017-14651-wso2.html
- https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0265
- https://github.com/cybersecurityworks/Disclosed/issues/15
