Skip to content
Heist/ feed
Back to feed
Medium

Security advisory

Type: advisorySources: OSVCVE: CVE-2020-17454

WSO2 API Manager 3.1.0 and earlier has reflected XSS on the "publisher" component's admin interface. More precisely, it is possible to inject an XSS payload into the owner POST parameter, which does not filter user inputs. By putting an XSS payload in place of a valid Owner Name, a modal box appears that writes an error message concatenated to the injected payload (without any form of data encoding). This can also be exploited via CSRF.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2020-17454
Confirmed fixed CVEs
Not specified
Updated in this feed
1 Nov 2026, 07:20 UTC · Revision 1

Source evidence

CVE-2020-17454

core-osv · Original source

Published 21 Oct 2020, 22:15 UTC

WSO2 API Manager 3.1.0 and earlier has reflected XSS on the "publisher" component's admin interface. More precisely, it is possible to inject an XSS payload into the owner POST parameter, which does not filter user inputs. By putting an XSS payload in place of a valid Owner Name, a modal box appears that writes an error message concatenated to the injected payload (without any form of data encoding). This can also be exploited via CSRF.

osv:CVE-2020-17454
Complete source record
{
  "id": "d5bb9b0b54ffe4a77c31a1a0c20ec6c928ead598a8eb970842ae23e444e1fecf",
  "url": "https://osv.dev/vulnerability/CVE-2020-17454",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2020-17454",
    "summary": "WSO2 API Manager 3.1.0 and earlier has reflected XSS on the \"publisher\" component's admin interface. More precisely, it is possible to inject an XSS payload into the owner POST parameter, which does not filter user inputs. By putting an XSS payload in place of a valid Owner Name, a modal box appears that writes an error message concatenated to the injected payload (without any form of data encoding). This can also be exploited via CSRF.",
    "evidence": "osv:CVE-2020-17454",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2020-17454",
      "aliases": [
        "CVE-2020-17454"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/wso2/product-apim",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "2971de274564b622974de831403e9688a4a76c14"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "3.1.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v3.1.0-rc3",
            "v3.1.0",
            "v3.0.0-rc3",
            "v3.0.0",
            "v3.1.0-rc2",
            "v3.1.0-rc1",
            "v3.1.0-beta",
            "v3.1.0-alpha",
            "v3.1.0-m5",
            "v3.1.0-m4",
            "v3.1.0-m3",
            "v3.1.0-m2",
            "v3.1.0-m1",
            "v3.0.0-rc2",
            "v3.0.0-rc1",
            "v3.0.0-beta",
            "v3.0.0-alpha2",
            "v3.0.0-alpha",
            "v3.0.0-m35",
            "v3.0.0-m34",
            "v3.0.0-m33",
            "v3.0.0-m32",
            "v2.6.0-rc3",
            "v2.6.0",
            "v2.6.0-rc2",
            "v2.6.0-rc1",
            "v2.6.0-beta2",
            "v2.6.0-beta",
            "v2.6.0-alpha2",
            "v2.6.0-alpha",
            "v2.6.0-m2",
            "v2.6.0-m1",
            "v2.5.0-rc4",
            "v2.5.0",
            "v2.5.0-rc3",
            "v2.5.0-rc2",
            "v2.5.0-rc1",
            "v2.5.0-Beta",
            "v2.5.0-Alpha",
            "v2.2.0-update7",
            "v2.2.0-update6",
            "v2.2.0-update5",
            "v2.2.0-update4",
            "v2.2.0-update3",
            "v2.2.0-update2",
            "v2.2.0-update1",
            "v2.2.0",
            "v2.1.0-update14",
            "v2.1.0-update13",
            "v2.1.0-update12",
            "v2.1.0-update11",
            "v2.1.0-update10",
            "v2.1.0-update9",
            "v2.1.0-update8",
            "v2.1.0-update7",
            "v2.1.0-update5",
            "v2.1.0-update3",
            "v2.1.0-update2",
            "v2.1.0-update1",
            "v2.1.0-alpha",
            "v2.0.0-ALPHA",
            "v2.0.0-M4",
            "v1.9.0",
            "v1.9.0-Beta-3",
            "v1.9.0-Beta-2",
            "v1.9.0-Beta",
            "v1.9.0-Alpha",
            "test-tag-1.9.0-Alpha",
            "v1.9.0-M2"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-17454.json"
          }
        }
      ],
      "modified": "2026-10-24T10:30:51.965421072Z",
      "provider": "osv",
      "references": [
        "https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0843"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2020-17454",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 437593,
  "published_at": "2020-10-21T22:15:12.01+00:00"
}