CVE-2020-14445: 
WSO2 Identity Server vulnerability analysis and mitigation

A potential Reflected Cross-Site Scripting (XSS) vulnerability was identified in WSO2 Identity Server through version 5.9.0 and WSO2 IS as Key Manager through version 5.9.0. The vulnerability exists in the Management Console Basic Policy Editor user interface. The issue was discovered in January 2020 and publicly disclosed in May 2020 (CSW Advisory).

The vulnerability is classified as a Cross-Site Scripting (CWE-79) issue with a CVSS v3.1 Base Score of 5.4 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The vulnerability exists in the Policy Administration section where an attacker can inject malicious JavaScript code through the 'RuleID' variable in the Basic Policy Editor interface (CSW Advisory).

When exploited, this XSS vulnerability could allow attackers to execute arbitrary JavaScript code in users' browsers while connected to the trusted web site. While the attack targets users rather than the application itself, it uses the application as an attack vector. However, since session-related sensitive cookies are protected with httpOnly flag, session hijacking attacks are not possible (CSW Advisory).

The vulnerability requires an authenticated user with access to the Policy Administration interface. The exploit involves injecting malicious JavaScript code through the 'RuleID' parameter in the Basic Policy Editor. The injected payload gets stored and executes whenever a user visits the affected page (CSW Advisory).

Users should upgrade to a patched version of the software. The fix has been implemented through changes in the carbon-identity-framework, available at the public fix repository. The changes can be applied based on the modifications detailed in pull request #2794 (CSW Advisory).