Back to search
CVE-2021-36760
Published: Dec 7, 2021
Modified: Aug 4, 2024
PUBLISHED
Description
In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL that precedes the callback parameter. Once the username or password reset procedure is completed, the JavaScript code will be executed. (recoverpassword.do also has an open redirect issue for a similar reason.)
| Vendor | Product | Versions |
|---|---|---|
n/a | n/a | affected n/a |
References
https://docs.wso2.com/display/Security/2021+Advisories
x_refsource_MISC
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now