CVE:CVE-2020-24703
CNNVD:CNNVD-202008-1347
WSO2 products中存在安全漏洞，该漏洞源于Carbon管理控制端可以将cookie信息发送给攻击者，主要受影响范围如下：API Manager 2.2.0版本, API Manager Analytics 2.2.0版本,API Microgateway 2.2.0版本,Data Analytics Server 3.2.0版本,Enterprise Integrator 从6.6.0开始版本, IS as Key Manager 5.5.0版本, Identity Server 5.5.0版本和5.8.0版本, Identity Server Analytics 5.5.0版本,IoT Server 3.3.0版本和3.3.1版本.
solution:Upgrade wso2 api_manager to a higher version than 2.2.0,and avoid the version 2.2.0; Upgrade wso2 api_manager_analytics to a higher version than 2.2.0,and avoid the version 2.2.0; Upgrade wso2 api_microgateway to a higher version than 2.2.0,and avoid the version 2.2.0; Upgrade wso2 data_analytics_server to a higher version than 3.2.0,and avoid the version 3.2.0; Upgrade wso2 enterprise_integrator to a higher version than 6.6.0,and avoid the version (,6.6.0]; Upgrade wso2 identity_server to a higher version than 5.5.0,5.8.0,and avoid the version 5.5.0,5.8.0; Upgrade wso2 identity_server_analytics to a higher version than 5.5.0,and avoid the version 5.5.0; Upgrade wso2 identity_server_as_key_manager to a higher version than 5.5.0,and avoid the version 5.5.0; Upgrade wso2 iot_server to a higher version than 3.3.0,3.3.1,and avoid the version 3.3.0,3.3.1