What this actually is.
Technical background, root cause, and affected surface.
WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.
- Vendor
- WSO2
- Affected Product
- WSO2
- CVE
- CVE-2017-14651
- Securin ID
- 2017-CSW-09-1017
- Status
- Fixed
- Date
- July 21, 2017
- Severity
- Medium
- CVSS Score
- 4.8
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- CWE
- CWE-79
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
Issue 1: Accessing the POST Request of the URL, https://WSO2IP:9443/carbon/resources/add_collection_ajaxprocessor.jsp with XSS payloads through vulnerable variable collectionName and parentPath will execute XSS in the victim’s browser.
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
An attacker can make the browser get redirected to a malicious website, make changes in the UI of the web page, and retrieve information from the browser.
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Download the relevant patch based on your version.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Discovered in WSO2 Data Analytics Server Product version 3.1.0
Reported to WSO2
WSO2 security team acknowledged the vulnerability
Issue 01 was confirmed, issue 02 reported earlier, and fixed
Public patching was in progress
Updated the patch
Timeline recorded · Disclosure coordinated by Securin
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.