CVE-2021-36760: XSS
In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL that precedes the callback parameter. Once the username or password reset procedure is completed, the JavaScript code will be executed. (recoverpassword.do also has an open redirect issue for a similar reason.)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-36760?
The severity of CVE-2021-36760 is medium with a CVSS score of 6.1.
Which software versions are affected by CVE-2021-36760?
CVE-2021-36760 affects WSO2 Identity Server versions 5.7.0, 5.8.0, 5.9.0, 5.10.0, and 5.11.0, as well as WSO2 Identity Server as Key Manager versions 5.3.0, 5.5.0, 5.6.0, 5.7.0, 5.9.0, and 5.10.0.
What is the vulnerability description of CVE-2021-36760?
CVE-2021-36760 is a DOM-Based XSS vulnerability in WSO2 Identity Server 5.7.0 that allows an attacker to modify the URL and execute malicious JavaScript code during the username or password reset procedure.
How can I fix CVE-2021-36760?
To fix CVE-2021-36760, it is recommended to upgrade to a fixed version of WSO2 Identity Server or apply the necessary security patches provided by the vendor.
Where can I find more information about CVE-2021-36760?
More information about CVE-2021-36760 can be found in the WSO2 Security Advisories documentation, specifically advisory WSO2-2021-1314.