CVE-2020-14446: 
WSO2 Identity Server vulnerability analysis and mitigation

An open redirect vulnerability (CVE-2020-14446) was discovered in WSO2 Identity Server through version 5.10.0 and WSO2 IS as Key Manager through version 5.10.0. The vulnerability was discovered on January 31, 2020, and was publicly disclosed on June 5, 2020 (CSW Report).

The vulnerability allows client-side URL redirection when the application incorporates user-controllable data into the target of a redirection in an unsafe way. The issue was found in the Policy Administration section where clicking the 'Add New Entitlement Policy' link and using the 'Write Policy in XML' feature allows entering a malicious domain in the CallbackURL variable. The CVSS v3.1 base score is 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (NVD).

An attacker can construct a URL within the application that causes a redirection to an arbitrary external domain. This behavior can be leveraged to facilitate phishing attacks against users of the application (CSW Report).

The vulnerability requires user interaction to be exploited. A proof of concept exists demonstrating how an attacker can trigger URL navigation script and redirect to a custom entered domain through the Policy Administration interface (CSW Report).

Users should download and apply the relevant fixes based on the changes from the public fix available in the carbon-identity-framework repository (CSW Report).