CVE-2018-20737

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. Reflected XSS exists in the carbon part of the product.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/wso2-extensions/identity-inbound-auth-oauth/pull/978/filesPatch, Third Party Advisory
https://wso2.com/security-patch-releases/api-managerPatch, Third Party Advisory, Vendor Advisory
https://www.excellium-services.com/cert-xlm-advisory/cve-2018-20737/Patch, Third Party Advisory
https://github.com/wso2-extensions/identity-inbound-auth-oauth/pull/978/filesPatch, Third Party Advisory
https://wso2.com/security-patch-releases/api-managerPatch, Third Party Advisory, Vendor Advisory
https://www.excellium-services.com/cert-xlm-advisory/cve-2018-20737/Patch, Third Party Advisory

Timeline

Published: Mar 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-207427.5An issue was discovered in UC Berkeley RISE Opaque before 2018-12-01. There is no boundary check on ocall_malloc. The return value could be CVE-2018-207437.5murmur in Mumble through 1.2.19 before 2018-08-31 mishandles multiple concurrent requests that are persisted in the database, which allows r CVE-2018-207445.9The Olivier Poitrey Go CORS handler through 1.3.0 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value,CVE-2018-207455.9Yii 2.x through 2.0.15.1 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible wi CVE-2018-207489.8LibVNC before 0.9.12 contains multiple heap out-of-bounds write vulnerabilities in libvncclient/rfbproto.c. The fix for CVE-2018-20019 was i CVE-2018-207499.8LibVNC before 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was incomplet CVE-2018-207509.8LibVNC through 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was incomple CVE-2018-207518.8An issue was discovered in crop_page in PoDoFo 0.9.6. For a crafted PDF document, pPage->GetObject()->GetDictionary().AddKey(PdfName("MediaB CVE-2018-207529.8An issue was discovered in Recon-ng before 4.9.5. Lack of validation in the modules/reporting/csv.py file allows CSV injection. More specifi CVE-2018-207539.8Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShel CVE-2018-207556.1MODX Revolution through v2.7.0-pl allows XSS via the User Photo field.CVE-2018-207566.1MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a Qui