An issue exists in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim submits a crafted Try It request, aka Session Hijacking. This affects API Manager up to and including 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager up to and including 5.10.0, Identity Server up to and including 5.10.0, Identity Server Analytics up to and including 5.6.0, and IoT Server 3.1.0.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
wso2 identity server analytics |
||
wso2 identity server as key manager |
||
wso2 identity server |
||
wso2 api manager |
||
wso2 api manager analytics 2.5.0 |
||
wso2 iot server 3.1.0 |
Vulmon