Overview :
An attacker can trick a privileged user while using WSO2 IS as Key Manager
Affected Product(s) :
  • WSO2 IS as Key Manager 5.7.0
Vulnerability Details :
CVE ID : CVE-2019-18882
A reflected XSS attack could be performed in the dashboard user profile by sending an HTTP GET request with harmful request parameters. Further, a stored XSS attack could be performed in the download-userinfo. jag due to an improper Content-Type of the downloading content.
CVE ID : CVE-2019-18881
WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile.

Solution :

Apply the following patch based on your product version by following the instructions in the README file. If you have any questions, post them to security@wso2.com.

Please download the relevant patch based on the product you use following the matrix below. The patch can also be downloaded from http://wso2.com/security-patch-releases/.

Code Product Version Patch
IS KM WSO2 IS as Key Manager 5.7.0 WSO2-CARBON-PATCH-4.4.0-5019