CVE-2020-24705

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim submits a crafted Try It request, aka Session Hijacking. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10.0, Identity Server Analytics through 5.6.0, and IoT Server 3.1.0.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Aug 27, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-247066.1An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0, API Manager CVE-2020-247077.8Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content.CVE-2020-247085.4Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form.CVE-2020-247095.4Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template.CVE-2020-247105.3Gophish before 0.11.0 allows SSRF attacks.CVE-2020-247116.5The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attaCVE-2020-247125.4Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page.CVE-2020-247137.5Gophish through 0.10.1 does not invalidate the gophish cookie upon logout.CVE-2020-247149.8The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, the openssl binary is called without tCVE-2020-247159.8The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, native Python code is used that lacks CVE-2020-247167.8OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories.CVE-2020-247177.8OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterprets group permissions as user permissions, as demonstrated by mode 0770 being equi