CVE-2020-27885

{"id": "CVE-2020-27885", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2020-10-29T21:15:15.957", "references": [{"url": "https://docs.wso2.com/display/Security/2020+Advisories", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.rodrigofavarini.com.br/cybersecurity/multiple-xss-on-api-manager-3-1-0/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-Site Scripting (XSS) vulnerability on WSO2 API Manager 3.1.0. By exploiting a Cross-site scripting vulnerability the attacker can hijack a logged-in user\u2019s session by stealing cookies which means that a malicious hacker can change the logged-in user\u2019s password and invalidate the session of the victim while the hacker maintains access."}, {"lang": "es", "value": "Una vulnerabilidad de tipo Cross-Site Scripting (XSS) en WSO2 API Manager versi\u00f3n 3.1.0. Al explotar una vulnerabilidad de tipo Cross-site scripting el atacante puede secuestrar la sesi\u00f3n de un usuario conectado mediante el robo de cookies, lo que significa que un hacker malicioso puede cambiar la contrase\u00f1a del usuario conectado e invalidar la sesi\u00f3n de la v\u00edctima mientras el hacker mantiene el acceso"}], "lastModified": "2020-11-03T17:23:21.667", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1344FB79-0796-445C-A8F3-C03E995925D1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}