CVE-2020-24706: 
WSO2 API Manager vulnerability analysis and mitigation

A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in certain WSO2 products' Try It tool, identified as CVE-2020-24706. The vulnerability was disclosed on August 27, 2020, affecting multiple WSO2 products including API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10.0, Identity Server Analytics through 5.6.0, and IoT Server 3.1.0 (NVD, WSO2 Advisory).

The vulnerability allows Reflected XSS through the SOAP service Try It tool when processing malicious JavaScript payloads. The CVSS v3.1 base score is 6.1 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), indicating a network-exploitable vulnerability requiring user interaction. The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

An attacker exploiting this vulnerability can cause browser redirections to malicious websites, make unauthorized changes to web page UI, retrieve information from the browser, or cause other harmful effects. The vulnerability requires user interaction to be exploited (WSO2 Advisory).

The vulnerability can be exploited by sending a request to the SOAP service Try It tool with a malicious JavaScript payload. The attack requires user interaction, as indicated by the CVSS metrics, but does not require authentication (NVD).

WSO2 recommends users migrate to the latest released version of the affected products. For community users, public fixes are available through GitHub pull requests (https://github.com/wso2/carbon-kernel/pull/2669, https://github.com/wso2/carbon-kernel/pull/2663, https://github.com/wso2/carbon-kernel/pull/2662). WSO2 subscription holders should update their products to the specified update level or higher (WSO2 Advisory).