CVE-2024-7103: Reflected Cross-Site Scripting (XSS) in WSO2 Identity Server 7.0.0 Sub-Organization Login Flow
A reflected cross-site scripting (XSS) vulnerability exists in the sub-organization login flow of WSO2 Identity Server 7.0.0 due to improper input validation. A malicious actor can exploit this vulnerability to inject arbitrary JavaScript into the login flow, potentially leading to UI modifications, redirections to malicious websites, or data exfiltration from the browser.
While this issue could allow an attacker to manipulate the user’s browser, session-related sensitive cookies remain protected with the httpOnly flag, preventing session hijacking.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7103?
CVE-2024-7103 is rated as a high severity reflected cross-site scripting (XSS) vulnerability.
How do I fix CVE-2024-7103?
To fix CVE-2024-7103, ensure to apply the latest updates from WSO2 for Identity Server 7.0.0 that address this vulnerability.
What are the potential impacts of exploiting CVE-2024-7103?
Exploiting CVE-2024-7103 could allow a malicious actor to execute arbitrary JavaScript in the context of the user's session, leading to unauthorized actions.
In which version of WSO2 Identity Server does CVE-2024-7103 exist?
CVE-2024-7103 exists in WSO2 Identity Server version 7.0.0.
How can I determine if my WSO2 Identity Server is affected by CVE-2024-7103?
You can determine if your WSO2 Identity Server is affected by checking if you are running version 7.0.0 or older without the necessary patches.