medium4.8
CVE-2017-14651
WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.
Impact
WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wso2 | Api Manager | Version 2.1.0 |
| Wso2 | App Manager | Version 1.2.0 |
| Wso2 | Application Server | Version 5.3.0 |
| Wso2 | Business Process Server | Version 3.6.0 |
| Wso2 | Business Rules Server | Version 2.2.0 |
| Wso2 | Complex Event Processor | Version 4.2.0 |
| Wso2 | Dashboard Server | Version 2.0.0 |
| Wso2 | Data Analytics Server | Version 3.1.0 |
| Wso2 | Data Services Server | Version 3.5.1 |
| Wso2 | Enterprise Integrator | Version 6.1.1 |
| Wso2 | Enterprise Mobility Manager | Version 2.2.0 |
| Wso2 | Governance Registry | Version 5.4.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://cybersecurityworks.com/zerodays/cve-2017-14651-wso2.html
- https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0265
- https://github.com/cybersecurityworks/Disclosed/issues/15
- https://cybersecurityworks.com/zerodays/cve-2017-14651-wso2.html
- https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0265
- https://github.com/cybersecurityworks/Disclosed/issues/15