CVE-2018-8716: WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers

Medium severity · published Apr 25, 2018

CVE-2018-8716

WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers

5.4

CVSS

38.1%

EPSS

On KEV

Description

WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)38.1% · higher than 99% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Identity Server · Wso2

before 5.5.0 · source: NVD

Affected product

Identity Server

Wso2

All Identity Server CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2018-8716

CVE.org

https://www.cve.org/CVERecord?id=CVE-2018-8716

Exploit

http://packetstormsecurity.com/files/147330/WSO2-Identity-Server-5.3.0-Cross-Site-Scripting.html

Exploit

http://seclists.org/fulldisclosure/2018/Apr/45

Exploit

http://www.securityfocus.com/archive/1/541954/100/0/threaded

Exploit

https://www.exploit-db.com/exploits/44531/

Exploit

https://www.sec-consult.com/en/blog/advisories/multiple-stored-xss-vulnerabilities-in-wso2-carbon-and-dashboard-server/index.html