CVE-2020-24704
Estado: ModificadaMedia (6.1)—
An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager 2.2.0, API Manager Analytics 2.2.0, API Microgateway 2.2.0, Data Analytics Server 3.2.0, Enterprise Integrator through 6.6.0, IS as Key Manager 5.5.0, Identity Server 5.5.0 and 5.8.0, Identity Server Analytics 5.5.0, and IoT Server 3.3.0 and 3.3.1.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Puntuación base: 6.1
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.72%
- Percentil entre todas las CVEs puntuadas: 52
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (9)
CWE
- CWE-79
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2020-24704",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "cve@mitre.org",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 6.1,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 2.7,
"exploitabilityScore": 2.8
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 6.1,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 2.7,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2020-08-27T16:15:11.677",
"references": [
{
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2020/WSO2-2020-0685/",
"source": "cve@mitre.org"
},
{
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2020/WSO2-2020-0685/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager 2.2.0, API Manager Analytics 2.2.0, API Microgateway 2.2.0, Data Analytics Server 3.2.0, Enterprise Integrator through 6.6.0, IS as Key Manager 5.5.0, Identity Server 5.5.0 and 5.8.0, Identity Server Analytics 5.5.0, and IoT Server 3.3.0 and 3.3.1."
},
{
"lang": "es",
"value": "Se detectó un problema en determinados productos WSO2. La herramienta Try It permite un ataque de tipo XSS Reflejado. Esto afecta a API Manager versión 2.2.0, API Manager Analytics versión 2.2.0, API Microgateway versión 2.2.0, Data Analytics Server versión 3.2.0, Enterprise Integrator versiones hasta 6.6.0, IS as Key Manager versión 5.5.0, Identity Server versiones 5.5.0 y 5.8 .0, Identity Server Analytics versión 5.5.0 y IoT Server versiones 3.3.0 y 3.3.1"
}
],
"lastModified": "2026-06-17T03:06:00.320",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:api_manager:2.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6819491F-C6C3-41C1-B27A-0D0B62224977"
},
{
"criteria": "cpe:2.3:a:wso2:api_manager_analytics:2.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ADEAF56C-4583-40A6-826F-01AC86191AD7"
},
{
"criteria": "cpe:2.3:a:wso2:api_microgateway:2.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "79CDDE83-4CB6-4DA3-8E96-FCDA4F5C1E93"
},
{
"criteria": "cpe:2.3:a:wso2:data_analytics_server:3.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5CCDDFAB-C8FC-41C4-9872-667C442F119B"
},
{
"criteria": "cpe:2.3:a:wso2:enterprise_integrator:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "16E39585-2B28-4631-A62F-27F17DC9AB4A",
"versionEndIncluding": "6.6.0"
},
{
"criteria": "cpe:2.3:a:wso2:identity_server:5.5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8DA0050E-D5DD-45E5-9F61-DC1BB060EFF0"
},
{
"criteria": "cpe:2.3:a:wso2:identity_server:5.8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2B169832-A746-49A6-8E92-06624AA9B13A"
},
{
"criteria": "cpe:2.3:a:wso2:identity_server_analytics:5.5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "42BFE7A0-A168-4C1E-8725-41DD500C837E"
},
{
"criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:5.5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E4F0F121-700C-4D30-BAFC-960DCC56F08B"
},
{
"criteria": "cpe:2.3:a:wso2:iot_server:3.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FCAD802D-4746-49D2-AC21-7956F46274A7"
},
{
"criteria": "cpe:2.3:a:wso2:iot_server:3.3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "53EC589C-09C6-440C-AF9A-DD86A23311FE"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}