Search
Find a vulnerability
Search criteria
3 vulnerabilities found for Business Process Server by WSO2
CVE-2026-78674 (GCVE-0-2026-78674)
Vulnerability from nvd – Published: 2026-10-28 19:21 – Updated: 2026-10-29 02:02 Unsupported When Assigned
VLAI
EPSS
VEX
Title
Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution
Summary
The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server.
An authenticated user can leverage this vulnerability to execute arbitrary commands with the privileges of the product's runtime account. The scope of potential damage is contingent upon the permissions assigned to this account.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 01:51 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | Enterprise Integrator (BPS profile) |
Affected:
0 , ≤ 6.6.0
(custom)
cpe:2.3:a:wso2:enterprise_integrator_bps_profile_:*:*:*:*:*:*:*:* |
|
| WSO2 | Business Process Server |
Affected:
0 , ≤ 3.6.0
(custom)
cpe:2.3:a:wso2:business_process_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78674",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T01:51:25.807572Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T02:02:13.846Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Enterprise Integrator (BPS profile)",
"vendor": "WSO2",
"versions": [
{
"lessThanOrEqual": "6.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Business Process Server",
"vendor": "WSO2",
"versions": [
{
"lessThanOrEqual": "3.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:enterprise_integrator_bps_profile_:*:*:*:*:*:*:*:*",
"versionEndIncluding": "6.6.0",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:business_process_server:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.6.0",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "sanskaar pathak"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server.\n\nAn authenticated user can leverage this vulnerability to execute arbitrary commands with the privileges of the product\u0027s runtime account. The scope of potential damage is contingent upon the permissions assigned to this account."
}
],
"value": "The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server.\n\nAn authenticated user can leverage this vulnerability to execute arbitrary commands with the privileges of the product\u0027s runtime account. The scope of potential damage is contingent upon the permissions assigned to this account."
}
],
"impacts": [
{
"capecId": "CAPEC-84",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-84 CAPEC-84: OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T19:21:38.203Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5692/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5692/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5692/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5692/#solution"
}
],
"source": {
"advisory": "WSO2-2026-5692",
"discovery": "EXTERNAL"
},
"tags": [
"unsupported-when-assigned"
],
"title": "Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2026-78674",
"datePublished": "2026-10-28T19:21:38.203Z",
"dateReserved": "2026-08-25T00:49:00.750Z",
"dateUpdated": "2026-10-29T02:02:13.846Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78674 (GCVE-0-2026-78674)
Vulnerability from cvelistv5 – Published: 2026-10-28 19:21 – Updated: 2026-10-29 02:02 Unsupported When Assigned
VLAI
EPSS
VEX
Title
Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution
Summary
The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server.
An authenticated user can leverage this vulnerability to execute arbitrary commands with the privileges of the product's runtime account. The scope of potential damage is contingent upon the permissions assigned to this account.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 01:51 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | Enterprise Integrator (BPS profile) |
Affected:
0 , ≤ 6.6.0
(custom)
cpe:2.3:a:wso2:enterprise_integrator_bps_profile_:*:*:*:*:*:*:*:* |
|
| WSO2 | Business Process Server |
Affected:
0 , ≤ 3.6.0
(custom)
cpe:2.3:a:wso2:business_process_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78674",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T01:51:25.807572Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T02:02:13.846Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Enterprise Integrator (BPS profile)",
"vendor": "WSO2",
"versions": [
{
"lessThanOrEqual": "6.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Business Process Server",
"vendor": "WSO2",
"versions": [
{
"lessThanOrEqual": "3.6.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:enterprise_integrator_bps_profile_:*:*:*:*:*:*:*:*",
"versionEndIncluding": "6.6.0",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:business_process_server:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.6.0",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "sanskaar pathak"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server.\n\nAn authenticated user can leverage this vulnerability to execute arbitrary commands with the privileges of the product\u0027s runtime account. The scope of potential damage is contingent upon the permissions assigned to this account."
}
],
"value": "The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server.\n\nAn authenticated user can leverage this vulnerability to execute arbitrary commands with the privileges of the product\u0027s runtime account. The scope of potential damage is contingent upon the permissions assigned to this account."
}
],
"impacts": [
{
"capecId": "CAPEC-84",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-84 CAPEC-84: OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T19:21:38.203Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5692/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5692/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5692/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5692/#solution"
}
],
"source": {
"advisory": "WSO2-2026-5692",
"discovery": "EXTERNAL"
},
"tags": [
"unsupported-when-assigned"
],
"title": "Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2026-78674",
"datePublished": "2026-10-28T19:21:38.203Z",
"dateReserved": "2026-08-25T00:49:00.750Z",
"dateUpdated": "2026-10-29T02:02:13.846Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
VAR-201709-0829
Vulnerability from variot - Updated: 2025-04-20 23:22WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter. WSO2DataAnalyticsServer is a data analysis server of WSO2 Corporation of the United States, which provides real-time analysis of data streams, complex event processing and machine learning. A cross-site scripting vulnerability exists in the carbon/resources/add_collection_ajaxprocessor.jsp file in WSO2DataAnalyticsServer version 3.1.0. A remote attacker can use this vulnerability to hijack a user's session with the help of the \342\200\230collectionName\342\200\231 or \342\200\230parentPath\342\200\231 parameter, and change the login user password, causing the user session to fail
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201709-0829",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "data analytics server",
"scope": "eq",
"trust": 3.0,
"vendor": "wso2",
"version": "3.1.0"
},
{
"model": "api manager",
"scope": "eq",
"trust": 2.4,
"vendor": "wso2",
"version": "2.1.0"
},
{
"model": "app manager",
"scope": "eq",
"trust": 2.4,
"vendor": "wso2",
"version": "1.2.0"
},
{
"model": "application server",
"scope": "eq",
"trust": 2.4,
"vendor": "wso2",
"version": "5.3.0"
},
{
"model": "business process server",
"scope": "eq",
"trust": 2.4,
"vendor": "wso2",
"version": "3.6.0"
},
{
"model": "business rules server",
"scope": "eq",
"trust": 2.4,
"vendor": "wso2",
"version": "2.2.0"
},
{
"model": "complex event processor",
"scope": "eq",
"trust": 2.4,
"vendor": "wso2",
"version": "4.2.0"
},
{
"model": "dashboard server",
"scope": "eq",
"trust": 2.4,
"vendor": "wso2",
"version": "2.0.0"
},
{
"model": "data services server",
"scope": "eq",
"trust": 2.4,
"vendor": "wso2",
"version": "3.5.1"
},
{
"model": "enterprise integrator",
"scope": "eq",
"trust": 2.4,
"vendor": "wso2",
"version": "6.1.1"
},
{
"model": "enterprise mobility manager",
"scope": "eq",
"trust": 1.8,
"vendor": "wso2",
"version": "2.2.0"
},
{
"model": "governance registry",
"scope": "eq",
"trust": 1.8,
"vendor": "wso2",
"version": "5.4.0"
},
{
"model": "identity server",
"scope": "eq",
"trust": 1.8,
"vendor": "wso2",
"version": "5.3.0"
},
{
"model": "iot server",
"scope": "eq",
"trust": 1.8,
"vendor": "wso2",
"version": "3.0.0"
},
{
"model": "machine learner",
"scope": "eq",
"trust": 1.8,
"vendor": "wso2",
"version": "1.2.0"
},
{
"model": "message broker",
"scope": "eq",
"trust": 1.8,
"vendor": "wso2",
"version": "3.2.0"
},
{
"model": "storage server",
"scope": "eq",
"trust": 1.8,
"vendor": "wso2",
"version": "1.5.0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-35425"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008295"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-992"
},
{
"db": "NVD",
"id": "CVE-2017-14651"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:wso2:api_manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:wso2:app_manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:wso2:application_server",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:wso2:business_process_server",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:wso2:business_rules_server",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:wso2:complex_event_processor",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:wso2:dashboard_server",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:wso2:data_analytics_server",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:wso2:data_services_server",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:wso2:enterprise_integrator",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:wso2:enterprise_mobility_manager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:wso2:governance_registry",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:wso2:identity_server",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:wso2:iot_server",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:wso2:machine_learner",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:wso2:message_broker",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:wso2:storage_server",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008295"
}
]
},
"cve": "CVE-2017-14651",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"exploitabilityScore": 6.8,
"id": "CVE-2017-14651",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 1.9,
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"exploitabilityScore": 6.8,
"id": "CNVD-2017-35425",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 1.7,
"id": "CVE-2017-14651",
"impactScore": 2.7,
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.8,
"baseSeverity": "Medium",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "CVE-2017-14651",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "High",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-14651",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2017-14651",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2017-35425",
"trust": 0.6,
"value": "LOW"
},
{
"author": "CNNVD",
"id": "CNNVD-201709-992",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2017-14651",
"trust": 0.1,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-35425"
},
{
"db": "VULMON",
"id": "CVE-2017-14651"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008295"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-992"
},
{
"db": "NVD",
"id": "CVE-2017-14651"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter. WSO2DataAnalyticsServer is a data analysis server of WSO2 Corporation of the United States, which provides real-time analysis of data streams, complex event processing and machine learning. A cross-site scripting vulnerability exists in the carbon/resources/add_collection_ajaxprocessor.jsp file in WSO2DataAnalyticsServer version 3.1.0. A remote attacker can use this vulnerability to hijack a user\u0027s session with the help of the \\342\\200\\230collectionName\\342\\200\\231 or \\342\\200\\230parentPath\\342\\200\\231 parameter, and change the login user password, causing the user session to fail",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-14651"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008295"
},
{
"db": "CNVD",
"id": "CNVD-2017-35425"
},
{
"db": "VULMON",
"id": "CVE-2017-14651"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-14651",
"trust": 3.1
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008295",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2017-35425",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201709-992",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2017-14651",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-35425"
},
{
"db": "VULMON",
"id": "CVE-2017-14651"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008295"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-992"
},
{
"db": "NVD",
"id": "CVE-2017-14651"
}
]
},
"id": "VAR-201709-0829",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-35425"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-35425"
}
]
},
"last_update_date": "2025-04-20T23:22:11.362000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "WSO2-2017-0265",
"trust": 0.8,
"url": "https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0265"
},
{
"title": "Patch for WSO2DataAnalyticsServer Cross-Site Scripting Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/106811"
},
{
"title": "WSO2 Data Analytics Server Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=75020"
},
{
"title": "Kenzer Templates [5170] [DEPRECATED]",
"trust": 0.1,
"url": "https://github.com/ARPSyndicate/kenzer-templates "
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-35425"
},
{
"db": "VULMON",
"id": "CVE-2017-14651"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008295"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-992"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008295"
},
{
"db": "NVD",
"id": "CVE-2017-14651"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.1,
"url": "https://github.com/cybersecurityworks/disclosed/issues/15"
},
{
"trust": 1.7,
"url": "https://docs.wso2.com/display/security/security+advisory+wso2-2017-0265"
},
{
"trust": 1.7,
"url": "https://cybersecurityworks.com/zerodays/cve-2017-14651-wso2.html"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-14651"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-14651"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/79.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/arpsyndicate/kenzer-templates"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-35425"
},
{
"db": "VULMON",
"id": "CVE-2017-14651"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008295"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-992"
},
{
"db": "NVD",
"id": "CVE-2017-14651"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2017-35425"
},
{
"db": "VULMON",
"id": "CVE-2017-14651"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008295"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-992"
},
{
"db": "NVD",
"id": "CVE-2017-14651"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-11-29T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-35425"
},
{
"date": "2017-09-21T00:00:00",
"db": "VULMON",
"id": "CVE-2017-14651"
},
{
"date": "2017-10-13T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008295"
},
{
"date": "2017-09-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201709-992"
},
{
"date": "2017-09-21T18:29:00.167000",
"db": "NVD",
"id": "CVE-2017-14651"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-11-29T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-35425"
},
{
"date": "2020-11-09T00:00:00",
"db": "VULMON",
"id": "CVE-2017-14651"
},
{
"date": "2017-10-13T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008295"
},
{
"date": "2020-10-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201709-992"
},
{
"date": "2025-04-20T01:37:25.860000",
"db": "NVD",
"id": "CVE-2017-14651"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201709-992"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "WSO2 Data Analytics Server Cross-Site Scripting Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-35425"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-992"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201709-992"
}
],
"trust": 0.6
}
}