Medium severity · published Oct 4, 2017
CVE-2017-14995
The Management Console in WSO2 Application Server 5.3.0, WSO2 Business Process Server 3.6.0, WSO2 Business Rules Server 2.2.0, WSO2 Complex Event Processor 4.2.0, WSO2 Dashboard…
6.1
CVSS
0.6%
EPSS
No
On KEV
Description
The Management Console in WSO2 Application Server 5.3.0, WSO2 Business Process Server 3.6.0, WSO2 Business Rules Server 2.2.0, WSO2 Complex Event Processor 4.2.0, WSO2 Dashboard Server 2.0.0, WSO2 Data Analytics Server 3.1.0, WSO2 Data Services Server 3.5.1, and WSO2 Machine Learner 1.2.0 is affected by stored XSS.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Application Server · Wso2
5.3.0 · source: NVD
BP
Business Process Server · Wso2
3.6.0 · source: NVD
BR
Business Rules Server · Wso2
2.2.0 · source: NVD
CE
Complex Event Processor · Wso2
4.2.0 · source: NVD
DS
Dashboard Server · Wso2
2.0.0 · source: NVD
DA
Data Analytics Server · Wso2
3.1.0 · source: NVD
DS
Data Services Server · Wso2
3.5.1 · source: NVD
ML
Machine Learner · Wso2
1.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-14995
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-14995
Patch
https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0257
More from Application Server
4.8
CVE-2017-14651
WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter