Vulnerability Details CVE-2023-31664
A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do of WSO2 API Manager before 4.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tenantDomain parameter.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.144
EPSS Ranking 94.0%
CVSS Severity
CVSS v3 Score 6.1
References
- https://github.com/adilkhan7/CVE-2023-31664
- https://github.com/wso2/api-manager/issues?q=is%3Aissue+is%3Aclosed+label%3AComponent%2FAPIM+closed%3A2022-04-05..2023-03-11
- https://github.com/wso2/product-apim/releases/tag/v4.2.0
- https://github.com/adilkhan7/CVE-2023-31664
- https://github.com/wso2/api-manager/issues?q=is%3Aissue+is%3Aclosed+label%3AComponent%2FAPIM+closed%3A2022-04-05..2023-03-11
- https://github.com/wso2/product-apim/releases/tag/v4.2.0
Products affected by CVE-2023-31664
-
cpe:2.3:a:wso2:api_manager:-
-
cpe:2.3:a:wso2:api_manager:1.0.0
-
cpe:2.3:a:wso2:api_manager:1.1.1
-
cpe:2.3:a:wso2:api_manager:1.10.0
-
cpe:2.3:a:wso2:api_manager:1.2.0
-
cpe:2.3:a:wso2:api_manager:1.3.0
-
cpe:2.3:a:wso2:api_manager:1.3.1
-
cpe:2.3:a:wso2:api_manager:1.4.0
-
cpe:2.3:a:wso2:api_manager:1.5.0
-
cpe:2.3:a:wso2:api_manager:1.6.0
-
cpe:2.3:a:wso2:api_manager:1.7.0
-
cpe:2.3:a:wso2:api_manager:1.8.0
-
cpe:2.3:a:wso2:api_manager:1.9.0
-
cpe:2.3:a:wso2:api_manager:1.9.1
-
cpe:2.3:a:wso2:api_manager:2.0.0
-
cpe:2.3:a:wso2:api_manager:2.1.0
-
cpe:2.3:a:wso2:api_manager:2.2.0
-
cpe:2.3:a:wso2:api_manager:2.5.0
-
cpe:2.3:a:wso2:api_manager:2.6.0
-
cpe:2.3:a:wso2:api_manager:3.0.0
-
cpe:2.3:a:wso2:api_manager:3.1.0
-
cpe:2.3:a:wso2:api_manager:3.2.0
-
cpe:2.3:a:wso2:api_manager:4.0.0
-
cpe:2.3:a:wso2:api_manager:4.1.0