What this actually is.
Technical background, root cause, and affected surface.
An issue was discovered on HTTP post request in WSO2 API Manager 2.6.0 in the ‘implement phase’ of the API Publisher. A stored cross-site script (XSS) vulnerability allows an attacker to inject malicious code into the application.
- Vendor
- WSO2
- Affected Product
- WSO2 API Manager
- CVE
- CVE-2019-20441
- Securin ID
- 2019-CSW-01-1022
- Status
- Fixed
- Date
- July 6, 2019
- Severity
- Medium
- CVSS Score
- 4.8
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- CWE
- CWE-79
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The following vulnerability was tested on the WSO2 API Manager version 2.6.0 Product.
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Through an XSS attack, the attacker can make the browser redirect to a malicious website. Unauthorized actions such as changing the UI of the web page, retrieving information from the browser are possible. But since all session-related sensitive cookies are set with httpOnly flat and protected, session hijacking or mounting a similar attack would not be possible.
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Download the relevant patch based on the product version.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Discovered CVE-2019-20441 in WSO2 API Manager v2.6.0.
Reported to the intigriti platform.
Closed the issue in the intigriti platform as it was “out of scope.”
Reported to WSO2.
WS02 acknowledged the report.
Fixing began in all affected versions.
Public and customer announcement by the vendor about the vulnerability
Timeline recorded · Disclosure coordinated by Securin
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.