CVE-2020-17453: WSO2 API Manager

Medium severity, CVSS 6.1. EPSS: 26.2% chance of exploitation in the next 30 days.

WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.

Affected products

• WSO2 API Manager: up to and including 3.2.0
• WSO2 API Manager Analytics: version 2.2.0 only; version 2.5.0 only; version 2.6.0 only
• WSO2 API Microgateway: version 2.2.0 only
• WSO2 Enterprise Integrator: up to and including 6.6.0
• WSO2 Identity Server: up to and including 5.10.0
• WSO2 Identity Server Analytics: version 5.4.0 only; version 5.4.1 only; version 5.5.0 only; version 5.6.0 only
• WSO2 Identity Server As Key Manager: version 5.5.0 only; version 5.6.0 only; version 5.7.0 only; version 5.9.0 only; version 5.10.0 only
• WSO2 Micro Integrator: version 1.0.0 only

Published 2021-04-05. Last modified 2026-06-17.