CVE-2021-36760
- Source
- https://cve.org/CVERecord?id=CVE-2021-36760
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-36760.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2021-36760
- Published
- 2021-12-07T21:15:08.297Z
- Modified
- 2026-07-08T06:00:40.324392975Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL that precedes the callback parameter. Once the username or password reset procedure is completed, the JavaScript code will be executed. (recoverpassword.do also has an open redirect issue for a similar reason.)
- Database specific
{ "unresolved_ranges": [ { "vendor_product": "wso2:identity_server", "cpes": [ "cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*", "cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*", "cpe:2.3:a:wso2:identity_server:5.7.0:*:*:*:*:*:*:*", "cpe:2.3:a:wso2:identity_server:5.8.0:*:*:*:*:*:*:*", "cpe:2.3:a:wso2:identity_server:5.9.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "5.7.0" }, { "last_affected": "5.7.0" }, { "introduced": "5.8.0" }, { "last_affected": "5.8.0" }, { "introduced": "5.9.0" }, { "last_affected": "5.9.0" }, { "introduced": "5.10.0" }, { "last_affected": "5.10.0" }, { "introduced": "5.11.0" }, { "last_affected": "5.11.0" } ], "source": "CPE_STRING" }, { "vendor_product": "wso2:identity_server_as_key_manager", "cpes": [ "cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*", "cpe:2.3:a:wso2:identity_server_as_key_manager:5.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:wso2:identity_server_as_key_manager:5.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:wso2:identity_server_as_key_manager:5.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:wso2:identity_server_as_key_manager:5.7.0:*:*:*:*:*:*:*", "cpe:2.3:a:wso2:identity_server_as_key_manager:5.9.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "5.3.0" }, { "last_affected": "5.3.0" }, { "introduced": "5.5.0" }, { "last_affected": "5.5.0" }, { "introduced": "5.6.0" }, { "last_affected": "5.6.0" }, { "introduced": "5.7.0" }, { "last_affected": "5.7.0" }, { "introduced": "5.9.0" }, { "last_affected": "5.9.0" }, { "introduced": "5.10.0" }, { "last_affected": "5.10.0" } ], "source": "CPE_STRING" }, { "vendor_product": "wso2:iot_server", "cpes": [ "cpe:2.3:a:wso2:iot_server:3.3.1:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "3.3.1" }, { "last_affected": "3.3.1" } ], "source": "CPE_STRING" } ] }- References
Affected packages
Git / github.com/wso2/product-apim
Affected ranges
- Type
- GIT
- Repo
- https://github.com/wso2/product-apim
- Events
-
IntroducedLast affected
- Database specific
-
Show details
{ "cpe": [ "cpe:2.3:a:wso2:api_manager:3.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "extracted_events": [ { "introduced": "3.0.0" }, { "last_affected": "3.0.0" }, { "introduced": "3.1.0" }, { "last_affected": "3.1.0" }, { "introduced": "3.2.0" }, { "last_affected": "3.2.0" }, { "introduced": "4.0.0" }, { "last_affected": "4.0.0" } ] }
Affected versions
3.*
3.0.0
3.1.0
3.2.0
4.*
4.0.0
4.0.0-beta
v3.*
v3.0.0
v3.0.0-rc3
v3.1.0
v3.1.0-alpha
v3.1.0-beta
v3.1.0-m1
v3.1.0-m2
v3.1.0-m3
v3.1.0-m4
v3.1.0-m5
v3.1.0-rc1
v3.1.0-rc2
v3.1.0-rc3
v3.2.0
v3.2.0-alpha
v3.2.0-beta
v3.2.0-m1
v3.2.0-rc1
v3.2.0-rc2
v3.2.0-rc3
v3.2.0-rc4
v3.2.0-rc5
v3.2.0-rc6
v4.*
v4.0.0
v4.0.0-alpha
v4.0.0-beta
v4.0.0-m1
v4.0.0-m2
v4.0.0-m3
v4.0.0-m4
v4.0.0-m5
v4.0.0-m6
v4.0.0-m7
v4.0.0-m8
v4.0.0-rc