CVE-2020-24703 Details
Description
An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim submits a crafted Try It request, aka Session Hijacking. This affects API Manager 2.2.0, API Manager Analytics 2.2.0, API Microgateway 2.2.0, Data Analytics Server 3.2.0, Enterprise Integrator through 6.6.0, IS as Key Manager 5.5.0, Identity Server 5.5.0 and 5.8.0, Identity Server Analytics 5.5.0, and IoT Server 3.3.0 and 3.3.1.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wso2 api manager | 2.2.0 |
CPE
Remediation
| |
| wso2 api manager analytics | 2.2.0 |
CPE
Remediation
| |
| wso2 api microgateway | 2.2.0 |
CPE
Remediation
| |
| wso2 data analytics server | 3.2.0 |
CPE
Remediation
| |
| wso2 enterprise integrator | <= 6.6.0 |
CPE
Remediation
| |
| wso2 identity server | 5.5.0 5.8.0 |
CPE
Remediation
| |
| wso2 identity server analytics | 5.5.0 |
CPE
Remediation
| |
| wso2 identity server as key manager | 5.5.0 |
CPE
Remediation
| |
| wso2 iot server | 3.3.0 3.3.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | [email protected] |
| Jan 11, 2024 | CVE Modified | [email protected] |
| Sep 8, 2020 | Initial Analysis | [email protected] |