CVE:CVE-2017-14995
CNNVD:CNNVD-201710-419
WSO2 Application Server等都是美国WSO2公司的产品。WSO2 Application Server是一套基于云的应用服务器软件。WSO2 Business Process Server是一套业务流程服务器软件。Management Console是其中的一个管理控制台程序。
多款WSO2产品中的Management Console存在跨站脚本漏洞。远程攻击者可利用该漏洞将用户重定向到恶意的网站，更改Web页面的UI或从浏览器中检索信息。以下产品和版本受到影响：WSO2 Application Server 5.3.0版本；WSO2 Business Process Server 3.6.0版本；WSO2 Business Rules Server 2.2.0版本；WSO2 Complex Event Processor 4.2.0版本；WSO2 Dashboard Server 2.0.0版本；WSO2 Data Analytics Server 3.1.0版本；WSO2 Data Services Server 3.5.1版本；WSO2 Machine Learner 1.2.0版本。
solution:Upgrade wso2 application_server to a higher version than 5.3.0,and avoid the version 5.3.0; Upgrade wso2 business_process_server to a higher version than 3.6.0,and avoid the version 3.6.0; Upgrade wso2 business_rules_server to a higher version than 2.2.0,and avoid the version 2.2.0; Upgrade wso2 complex_event_processor to a higher version than 4.2.0,and avoid the version 4.2.0; Upgrade wso2 dashboard_server to a higher version than 2.0.0,and avoid the version 2.0.0; Upgrade wso2 data_analytics_server to a higher version than 3.1.0,and avoid the version 3.1.0; Upgrade wso2 data_services_server to a higher version than 3.5.1,and avoid the version 3.5.1; Upgrade wso2 machine_learner to a higher version than 1.2.0,and avoid the version 1.2.0