CVE-2017-14995 - Vulnerability Details - OpenCVE

The Management Console in WSO2 Application Server 5.3.0, WSO2 Business Process Server 3.6.0, WSO2 Business Rules Server 2.2.0, WSO2 Complex Event Processor 4.2.0, WSO2 Dashboard Server 2.0.0, WSO2 Data Analytics Server 3.1.0, WSO2 Data Services Server 3.5.1, and WSO2 Machine Learner 1.2.0 is affected by stored XSS.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Wso2	Application Server Business Process Server Business Rules Server Complex Event Processor Dashboard Server Data Analytics Server Data Services Server Machine Learner

Configuration 1 [-]

OR	cpe:2.3:a:wso2:application_server:5.3.0:::::::*
	cpe:2.3:a:wso2:business_process_server:3.6.0:::::::*
	cpe:2.3:a:wso2:business_rules_server:2.2.0:::::::*
	cpe:2.3:a:wso2:complex_event_processor:4.2.0:::::::*
	cpe:2.3:a:wso2:dashboard_server:2.0.0:::::::*
	cpe:2.3:a:wso2:data_analytics_server:3.1.0:::::::*
	cpe:2.3:a:wso2:data_services_server:3.5.1:::::::*
	cpe:2.3:a:wso2:machine_learner:1.2.0:::::::*

No data.

References

Link	Providers
https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0257

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2017-10-03T07:00:00

Updated: 2024-08-05T19:42:22.298Z

Reserved: 2017-10-03T00:00:00

Link: CVE-2017-14995

Vulnrichment

No data.

NVD

Status : Modified

Published: 2017-10-04T01:29:03.277

Modified: 2024-11-21T03:13:55.207

Link: CVE-2017-14995

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2017-10-03T00:00:00", "descriptions": [{"lang": "en", "value": "The Management Console in WSO2 Application Server 5.3.0, WSO2 Business Process Server 3.6.0, WSO2 Business Rules Server 2.2.0, WSO2 Complex Event Processor 4.2.0, WSO2 Dashboard Server 2.0.0, WSO2 Data Analytics Server 3.1.0, WSO2 Data Services Server 3.5.1, and WSO2 Machine Learner 1.2.0 is affected by stored XSS."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-10-03T06:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0257"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-14995", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Management Console in WSO2 Application Server 5.3.0, WSO2 Business Process Server 3.6.0, WSO2 Business Rules Server 2.2.0, WSO2 Complex Event Processor 4.2.0, WSO2 Dashboard Server 2.0.0, WSO2 Data Analytics Server 3.1.0, WSO2 Data Services Server 3.5.1, and WSO2 Machine Learner 1.2.0 is affected by stored XSS."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0257", "refsource": "CONFIRM", "url": "https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0257"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T19:42:22.298Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0257"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-14995", "datePublished": "2017-10-03T07:00:00", "dateReserved": "2017-10-03T00:00:00", "dateUpdated": "2024-08-05T19:42:22.298Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wso2:application_server:5.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "8891BAB1-C357-4BC7-8B7A-541B9698F0A2", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:business_process_server:3.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "E1F3AA02-B597-4C9F-936A-A4DC91F590B9", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:business_rules_server:2.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "5435A911-096A-4DEE-9E04-1D3CBF4D98D8", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:complex_event_processor:4.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "397D6C9B-62A5-42FC-AB3B-C03598C25A7D", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:dashboard_server:2.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "AF5FB891-085E-4777-B771-1CDC367B8848", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:data_analytics_server:3.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "941D83A5-1978-49AE-890D-E31980E2D6AA", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:data_services_server:3.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "DEC72298-39AC-450F-8419-951057332163", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:machine_learner:1.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "CE333EE1-8158-40AF-8367-ACDCAA498516", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The Management Console in WSO2 Application Server 5.3.0, WSO2 Business Process Server 3.6.0, WSO2 Business Rules Server 2.2.0, WSO2 Complex Event Processor 4.2.0, WSO2 Dashboard Server 2.0.0, WSO2 Data Analytics Server 3.1.0, WSO2 Data Services Server 3.5.1, and WSO2 Machine Learner 1.2.0 is affected by stored XSS."}, {"lang": "es", "value": "La consola de administraci\u00f3n en WSO2 Application Server 5.3.0, WSO2 Business Process Server 3.6.0, WSO2 Business Rules Server 2.2.0, WSO2 Complex Event Processor 4.2.0, WSO2 Dashboard Server 2.0.0, WSO2 Data Analytics Server 3.1.0, WSO2 Data Services Server 3.5.1 y WSO2 Machine Learner 1.2.0 se ha visto afectada por un Cross-Site Scripting (XSS) persistente."}], "id": "CVE-2017-14995", "lastModified": "2024-11-21T03:13:55.207", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-10-04T01:29:03.277", "references": [{"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0257"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0257"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}