CVE-2020-27885: wso2 api_manager Cross-site Scripting
Vulnerability summary
CVE-2020-27885 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in wso2 api_manager. EPSS estimates a 1.09% chance of exploitation in the next 30 days, higher than 65% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 29-10-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Cross-Site Scripting (XSS) vulnerability on WSO2 API Manager 3.1.0. By exploiting a Cross-site scripting vulnerability the attacker can hijack a logged-in user’s session by stealing cookies which means that a malicious hacker can change the logged-in user’s password and invalidate the session of the victim while the hacker maintains access.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.09%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
0.00 pp
From 1.09% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (rodrigofavarini.com.br)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Wso21 product
- api_manager3.1.0
1 vendor · 1 product
References
2 links- www.rodrigofavarini.com.br/cybersecurity/multiple-xss-on-api-manager-3-1-0/X Refsource MISCExploitThird Party Advisory