What this actually is.
Technical background, root cause, and affected surface.
A vulnerability was discovered on WSO2 products inline API documentation editor page of the API Publisher. A reflected cross-site script (XSS) vulnerability allows an attacker to perform in the inline API documentation editor page of the API Publisher by sending an HTTP GET request with a harmful request parameter for ‘docName.’
- Vendor
- WSO2
- Affected Product
- WSO2 API Manager
- CVE
- CVE-2019-20435
- Securin ID
- 2019-CSW-11-1027
- Status
- Fixed
- Date
- June 21, 2019
- Severity
- Medium
- CVSS Score
- 4.8
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- CWE
- CWE-79
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The POST request docName variable is vulnerable to reflected Cross-Site Scripting (XSS) in the URL, https://192.168.107.2:9443/publisher/site/blocks/documentation/ajax/docs.jag
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
By tricking a privileged user into clicking a created URL via email, IM, or a neutral web site, the attacker can make the browser get redirected to a malicious website, which makes changes in the UI of the web page and retrieve information from the browser or harm otherwise. But since all session-related sensitive cookies are set with httpOnly flat and protected, session hijacking or mounting a similar attack would not be possible.
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Download the relevant patch based on the product version.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Discovered in WSO2 API Manager Product version 2.6.0
Report sent to WS02.
WS02 acknowledged the report
Vendor informed their customers about the vulnerability
Public announcement by the vendor about the vulnerability
Timeline recorded · Disclosure coordinated by Securin
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.