CVE-2020-27885: 
WSO2 API Manager vulnerability analysis and mitigation

Cross-Site Scripting (XSS) vulnerability was discovered in WSO2 API Manager 3.1.0. The vulnerability was identified on October 29, 2020, and assigned identifier CVE-2020-27885. The vulnerability affects the WSO2 API Manager version 3.1.0 software (WSO2 Advisory, NVD).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue with a CVSS v3.1 Base Score of 6.1 (MEDIUM) and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability exists in multiple parameters including client_id, commonAuthCallerPath, forceAuth, isSaaSApp, redirect_uri, and several others that are susceptible to XSS attacks (Security Research).

By exploiting this Cross-site scripting vulnerability, an attacker can hijack a logged-in user's session by stealing cookies. This allows the malicious actor to change the logged-in user's password and invalidate the session of the victim while maintaining unauthorized access to the system (NVD).

The vulnerability can be exploited remotely and does not require authentication. The attack complexity is considered low, though it does require user interaction. Proof of concept exploits have been publicly documented, demonstrating the vulnerability in the API manager portal through various parameter injections (Security Research).

WSO2 has acknowledged the vulnerability and provided security advisories. Users are recommended to update to a patched version of the software as specified in the vendor's security advisory (WSO2 Advisory).