Medium severity · published Dec 7, 2021
CVE-2021-36760
In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL…
6.1
CVSS
0.7%
EPSS
No
On KEV
Description
In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL that precedes the callback parameter. Once the username or password reset procedure is completed, the JavaScript code will be executed. (recoverpassword.do also has an open redirect issue for a similar reason.)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Api Manager · Wso2
3.0.0; 3.1.0; 3.2.0; 4.0.0 · source: NVD
IS
Identity Server · Wso2
5.7.0; 5.8.0; 5.9.0; 5.10.0; 5.11.0 · source: NVD
IS
Identity Server AS Key Manager · Wso2
5.3.0; 5.5.0; 5.6.0; 5.7.0; 5.9.0; 5.10.0 · source: NVD
IS
Iot Server · Wso2
3.3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-36760
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-36760
Vendor Advisory
https://docs.wso2.com/display/Security/2021+Advisories
Vendor Advisory
https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1314
More from Api Manager
10.0
CVE-2026-5430
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
9.8
CVE-2022-29464
WSO2 Multiple Products Unrestrictive Upload of File Vulnerability
10.0
CVE-2026-2053
Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager
9.8
CVE-2026-1728
Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover
9.8
CVE-2025-9312
A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products