CVE-2020-24704

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager 2.2.0, API Manager Analytics 2.2.0, API Microgateway 2.2.0, Data Analytics Server 3.2.0, Enterprise Integrator through 6.6.0, IS as Key Manager 5.5.0, Identity Server 5.5.0 and 5.8.0, Identity Server Analytics 5.5.0, and IoT Server 3.3.0 and 3.3.1.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 27, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-247058.8An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled ser CVE-2020-247066.1An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0, API Manager CVE-2020-247077.8Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content.CVE-2020-247085.4Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form.CVE-2020-247095.4Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template.CVE-2020-247105.3Gophish before 0.11.0 allows SSRF attacks.CVE-2020-247116.5The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking atta CVE-2020-247125.4Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page.CVE-2020-247137.5Gophish through 0.10.1 does not invalidate the gophish cookie upon logout.CVE-2020-247149.8The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, the openssl binary is called without t CVE-2020-247159.8The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, native Python code is used that lacks CVE-2020-247167.8OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories.