CVE-2017-14651

Severity Score

4.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.

WSO2 Data Analytics Server 3.1.0 tiene una vulnerabilidad de tipo Cross-Site Scripting (XSS) en carbon/resources/add_collection_ajaxprocessor.jsp mediante los parámetros collectionName o parentPath.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Medium

Authentication

Single

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2017-09-21 CVE Reserved
2017-09-21 CVE Published
2023-05-08 EPSS Updated
2024-08-05 CVE Updated
2024-08-05 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (3)

URL	Tag	Source

URL	Date	SRC
https://cybersecurityworks.com/zerodays/cve-2017-14651-wso2.html	2024-08-05
https://github.com/cybersecurityworks/Disclosed/issues/15	2024-08-05

URL	Date	SRC
https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0265	2020-11-09

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Wso2 Search vendor "Wso2"		Api Manager Search vendor "Wso2" for product "Api Manager"				2.1.0 Search vendor "Wso2" for product "Api Manager" and version "2.1.0"		-		Affected
Wso2 Search vendor "Wso2"		App Manager Search vendor "Wso2" for product "App Manager"				1.2.0 Search vendor "Wso2" for product "App Manager" and version "1.2.0"		-		Affected
Wso2 Search vendor "Wso2"		Application Server Search vendor "Wso2" for product "Application Server"				5.3.0 Search vendor "Wso2" for product "Application Server" and version "5.3.0"		-		Affected
Wso2 Search vendor "Wso2"		Business Process Server Search vendor "Wso2" for product "Business Process Server"				3.6.0 Search vendor "Wso2" for product "Business Process Server" and version "3.6.0"		-		Affected
Wso2 Search vendor "Wso2"		Business Rules Server Search vendor "Wso2" for product "Business Rules Server"				2.2.0 Search vendor "Wso2" for product "Business Rules Server" and version "2.2.0"		-		Affected
Wso2 Search vendor "Wso2"		Complex Event Processor Search vendor "Wso2" for product "Complex Event Processor"				4.2.0 Search vendor "Wso2" for product "Complex Event Processor" and version "4.2.0"		-		Affected
Wso2 Search vendor "Wso2"		Dashboard Server Search vendor "Wso2" for product "Dashboard Server"				2.0.0 Search vendor "Wso2" for product "Dashboard Server" and version "2.0.0"		-		Affected
Wso2 Search vendor "Wso2"		Data Analytics Server Search vendor "Wso2" for product "Data Analytics Server"				3.1.0 Search vendor "Wso2" for product "Data Analytics Server" and version "3.1.0"		-		Affected
Wso2 Search vendor "Wso2"		Data Services Server Search vendor "Wso2" for product "Data Services Server"				3.5.1 Search vendor "Wso2" for product "Data Services Server" and version "3.5.1"		-		Affected
Wso2 Search vendor "Wso2"		Enterprise Integrator Search vendor "Wso2" for product "Enterprise Integrator"				6.1.1 Search vendor "Wso2" for product "Enterprise Integrator" and version "6.1.1"		-		Affected
Wso2 Search vendor "Wso2"		Enterprise Mobility Manager Search vendor "Wso2" for product "Enterprise Mobility Manager"				2.2.0 Search vendor "Wso2" for product "Enterprise Mobility Manager" and version "2.2.0"		-		Affected
Wso2 Search vendor "Wso2"		Governance Registry Search vendor "Wso2" for product "Governance Registry"				5.4.0 Search vendor "Wso2" for product "Governance Registry" and version "5.4.0"		-		Affected
Wso2 Search vendor "Wso2"		Identity Server Search vendor "Wso2" for product "Identity Server"				5.3.0 Search vendor "Wso2" for product "Identity Server" and version "5.3.0"		-		Affected
Wso2 Search vendor "Wso2"		Iot Server Search vendor "Wso2" for product "Iot Server"				3.0.0 Search vendor "Wso2" for product "Iot Server" and version "3.0.0"		-		Affected
Wso2 Search vendor "Wso2"		Machine Learner Search vendor "Wso2" for product "Machine Learner"				1.2.0 Search vendor "Wso2" for product "Machine Learner" and version "1.2.0"		-		Affected
Wso2 Search vendor "Wso2"		Message Broker Search vendor "Wso2" for product "Message Broker"				3.2.0 Search vendor "Wso2" for product "Message Broker" and version "3.2.0"		-		Affected
Wso2 Search vendor "Wso2"		Storage Server Search vendor "Wso2" for product "Storage Server"				1.5.0 Search vendor "Wso2" for product "Storage Server" and version "1.5.0"		-		Affected