VulnSocial

CVE-2020-17453Disclosures(wso2 / api_manager)

LOWCVSS 6.1 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.

wso2 CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Exploit / PoC references
Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • api_manager
  • api_manager_analytics
  • api_microgateway
  • enterprise_integrator

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosures: 1 classified signal
  • General: 1 classified signal
  • 2 total mentions across 1 day

Affected systems

Vendors
wso2
Products
api_managerapi_manager_analyticsapi_microgatewayenterprise_integratoridentity_serveridentity_server_analyticsidentity_server_as_key_managermicro_integrator

11 versions affected across 8 products

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-03-29: 2Technical Details · 2026-03-29: 203-29
Signal classification2 categories
Disclosures
150.0%
General
150.0%
Referenced assets2 URLs
Full discourse2 posts
  • 𝕏 Bug Bounty Writeups 𝕏@bountywriteups
    General

    From a Tiny Parameter to XSS — Hunting CVE-2020–17453 in a Public VDP | Cyber Tamarin https://cybertamarin.medium.com/from-a-tiny-parameter-to-xss-hunting-cve-2020-17453-in-a-public-vdp-cyber-tamarin-f6de9b690c3c?source=rss------bug_bounty-5 #bugbounty #bugbountytips #bugbountytip

    Post summary

    The article announces a hunt for the known CVE‑2020‑17453 cross‑site scripting vulnerability in a public VDP, providing minimal technical detail but no proof of concept, exploitation tool, patch, or evidence of active exploitation.

    000971.1K
    40.1K followersView on X
  • ‘BBWriteups’@bbwriteup
    Disclosures

    "From a Tiny Parameter to XSS — Hunting CVE-2020–17453 in a Public VDP | Cyber Tamarin" by Cyber Tamarin #BugBounty #Cybersecurity #Hacking #InfoSec https://cybertamarin.medium.com/from-a-tiny-parameter-to-xss-hunting-cve-2020-17453-in-a-public-vdp-cyber-tamarin-f6de9b690c3c

    Post summary

    The Medium article announces the identification of an XSS flaw, CVE‑2020‑17453, in a public vulnerability disclosure program, but does not provide a PoC, exploit, or mitigation details.

    0000048
    559 followersView on X
CPE platform detail17 entries

17 of 17 entries

PartVendorProductVersionTarget SWTarget HW
Appwso2api_manager---
Appwso2api_manager_analytics2.2.0--
Appwso2api_manager_analytics2.5.0--
Appwso2api_manager_analytics2.6.0--
Appwso2api_microgateway2.2.0--
Appwso2enterprise_integrator---
Appwso2identity_server---
Appwso2identity_server_analytics5.4.0--
Appwso2identity_server_analytics5.4.1--
Appwso2identity_server_analytics5.5.0--
Appwso2identity_server_analytics5.6.0--
Appwso2identity_server_as_key_manager5.10.0--
Appwso2identity_server_as_key_manager5.5.0--
Appwso2identity_server_as_key_manager5.6.0--
Appwso2identity_server_as_key_manager5.7.0--
Appwso2identity_server_as_key_manager5.9.0--
Appwso2micro_integrator1.0.0--

Explore more

Back to dashboardwso2 CVEsapi_manager vulnerabilities