What this actually is.
Technical background, root cause, and affected surface.
An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console Basic Policy Editor user interface.
- Vendor
- WSO2
- Affected Product
- WSO2
- CVE
- CVE-2020-14445
- Securin ID
- 2020-CSW-05-1043
- Status
- Fixed
- Date
- Feb 10, 2020
- Severity
- Medium
- CVSS Score
- 4.8
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CWE
- CWE-79
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The following vulnerability was tested on WSO2 Identity Server version 5.9.0 Product.
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
By leveraging an XSS attack, an attacker can make the browser get redirected to a malicious website, make changes in the UI of the web page, retrieve information from the browser or harm otherwise. However, since all the session related sensitive cookies are set with httpOnly flag and protected, session hijacking or similar attacks would not be possible.
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Apply the relevant fixes based on the changes from the public fix using the following link:
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Discovered in WSO2 Identity Server Manager version 5.9.0.
CSW Internal Review.
Reported to the WSO2 security team.
Published to the public.
Disclosed 103 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.