CVE-2020-24705: High severity wso2 api manager vulnerability
An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim submits a crafted Try It request, aka Session Hijacking. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10.0, Identity Server Analytics through 5.6.0, and IoT Server 3.1.0.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue in certain WSO2 products?
The vulnerability ID of this issue in certain WSO2 products is CVE-2020-24705.
What is the severity level of CVE-2020-24705?
The severity level of CVE-2020-24705 is high with a score of 8.8.
Which WSO2 products are affected by CVE-2020-24705?
The WSO2 products affected by CVE-2020-24705 include API Manager (up to version 3.1.0), API Manager Analytics (version 2.5.0), Identity Server (up to version 5.10.0), Identity Server Analytics (up to version 5.6.0), and Identity Server as Key Manager (up to version 5.10.0).
What is the description of CVE-2020-24705?
CVE-2020-24705 is a vulnerability in certain WSO2 products where a valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim submits a crafted Try It request, leading to session hijacking.
Where can I find more information about CVE-2020-24705?
You can find more information about CVE-2020-24705 at the following link: [Security Advisory WSO2-2020-0718](https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0718).