CVE:CVE-2020-14444
CNNVD:CNNVD-202006-1271
WSO2 Identity Server（IS）和WSO2 IS as Key Manager都是美国WSO2公司的产品。WSO2 Identity Server是一款身份认证服务器。WSO2 IS as Key Manager是一款密钥管理器。
WSO2 Identity Server 5.9.0及之前版本和WSO2 IS as Key Manager 5.9.0及之前版本中的Management Console Policy Administration用户界面存在跨站脚本漏洞。该漏洞源于WEB应用缺少对客户端数据的正确验证。攻击者可利用该漏洞执行客户端代码。
solution:Upgrade wso2 identity_server to a higher version than 5.9.0,and avoid the version (,5.9.0]; Upgrade wso2 identity_server_as_key_manager to a higher version than 5.9.0,and avoid the version (,5.9.0]