SecurinZero Days
    Email Us
    Zero-Day Research/CVE-2019-20441
    ▲ MediumCVSS 4.8✓ PatchedEPSS 0.00434%

    Stored Cross-Site Scripting in WSO2

    An issue was discovered in WSO2 API Manager 2.6.0. A potential Stored Cross-Site Scripting (XSS) vulnerability has been identified in the implement phase of the API Publisher.

    CVE IDCVE-2019-20441
    CVSS v3.14.8 Medium
    VendorWSO2
    CWECWE-79
    DisclosedJul 6, 2019
    StatusFixed
    All advisories
    • 01Description
    • 02Proof of Concept
    • 03Impact
    • 04Remediation
    • 05Timeline
    • 06References
    01/Description

    What this actually is.

    Technical background, root cause, and affected surface.

    An issue was discovered on HTTP post request in WSO2 API Manager 2.6.0 in the ‘implement phase’ of the API Publisher. A stored cross-site script (XSS) vulnerability allows an attacker to inject malicious code into the application.

    Vendor
    WSO2
    Affected Product
    WSO2 API Manager
    CVE
    CVE-2019-20441
    Securin ID
    2019-CSW-01-1022
    Status
    Fixed
    Date
    July 6, 2019
    Severity
    Medium
    CVSS Score
    4.8
    Vector
    CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
    CWE
    CWE-79
    02/Proof of Concept

    From one request
    to root shell.

    Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.

    4.8CVSS 3.1
    VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
    ScopeChanged
    ImpactC:L / I:L / A:N
    SeverityMedium

    The following vulnerability was tested on the WSO2 API Manager version 2.6.0 Product.

    PoC · Exploitation Steps▲ trigger
    01Issue 01: Stored Cross-Site Scripting.02Figure 01: Design an API with valid values in the required fields of the page.03Figure 02: Click on “Next Implement” after completing the forms with valid information.04Figure 03: Valid HTTP Request captured in the proxy with filled information.05Figure 04: ‘Context’ variable is added with XSS Payload, “><script>alert(document.cookie)</script>.06Figure 05: Submitted the API details to the server with XSS payload.07Figure 06: XSS Payload gets stored and reflects whenever the user views the publisher page.08Figure 07: Stored XSS payload in the source code.
    03/Impact

    What an attacker does to you.

    Post-exploitation outcomes mapped to CVSS impact metrics.

    Through an XSS attack, the attacker can make the browser redirect to a malicious website. Unauthorized actions such as changing the UI of the web page, retrieving information from the browser are possible. But since all session-related sensitive cookies are set with httpOnly flat and protected, session hijacking or mounting a similar attack would not be possible.

    04/Remediation

    Fix it. In this order.

    A runbook, not a checklist. Sequence matters — assume compromise before you act.

    Download the relevant patch based on the product version.

    Securin advisory — For coordinated remediation support or threat-actor briefings related to CVE-2019-20441, contact disclose@securin.io
    05/Disclosure Timeline

    Vendors moved in days.
    Attackers in hours.

    Reconstructed from vendor advisories, CISA bulletins, and Securin research records.

    Jul 05, 2019

    Discovered CVE-2019-20441 in WSO2 API Manager v2.6.0.

    Jul 06, 2019

    Reported to the intigriti platform.

    Jul 23, 2019

    Closed the issue in the intigriti platform as it was “out of scope.”

    Jul 26, 2019

    Reported to WSO2.

    Jul 26, 2019

    WS02 acknowledged the report.

    Aug 13, 2019

    Fixing began in all affected versions.

    Nov 04, 2019

    Public and customer announcement by the vendor about the vulnerability

    Timeline recorded · Disclosure coordinated by Securin

    06/References

    Cite, verify, go deeper.

    Primary sources — NVD, CISA KEV, and machine-readable IoC feed.

    NVD

    NVD — CVE-2019-20441

    nvd.nist.gov/vuln/detail/CVE-2019-20441 →
    SEC

    Securin VI — Full Technical Analysis

    vi.securin.io →

    Let Securin level up your security posture.

    Get a live exposure assessment, threat-actor briefing tailored to your sector, and IoC mapping for your SIEM.

    Browse all advisories
    SecurinSecurinZero Days

    Securin's zero-day research operation combines frontier AI models with a decade of offensive expertise — discovering, validating, and coordinating the disclosure of high-impact vulnerabilities at a scale and speed no human team achieves alone.

    Glossary
    © 2026 Securin Inc · CVE Numbering Authority
    Privacy Policy·Data Processing Addendum