Security readout for executives and security teams
Plain-English summary
CVE-2020-24703 is a high-severity session hijacking issue in several WSO2 products. A logged-in administrator’s Carbon Management Console session cookie may be exposed to an attacker-controlled server if the victim submits a crafted Try It request. The key business risk is unauthorized use of a privileged management session.
Executive priority
Prioritize this as high for organizations running affected WSO2 versions, especially where administrative consoles are reachable beyond tightly controlled networks. The issue can expose privileged sessions, creating a credible path to management-plane compromise.
Technical view
The issue affects listed WSO2 products including API Manager 2.2.0, Enterprise Integrator through 6.6.0, Identity Server 5.5.0 and 5.8.0, and IoT Server 3.3.0/3.3.1. CVSS 3.1 is 8.8 with network attack vector, low complexity, required user interaction, and high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely where affected WSO2 Carbon Management Console or Try It functionality is reachable by administrators. Organizations using the listed legacy WSO2 versions should treat admin-accessible deployments as potentially exposed until checked against WSO2 advisory guidance.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation evidence. Exploitation requires victim interaction: a valid console user must submit a crafted Try It request that can disclose the session cookie to an attacker-controlled server.
Researcher notes
Evidence is limited to the CVE description, CVSS vector, affected product list, KEV false status, and WSO2 advisory reference. Do not assume exploit availability or a specific patch level from this bundle alone; verify remediation details directly with WSO2 advisory WSO2-2020-0687.
Mitigation direction
- Inventory WSO2 deployments and identify listed affected products and versions.
- Review WSO2 Security Advisory WSO2-2020-0687 for vendor-supported fixes or mitigations.
- Prioritize remediation for internet-reachable or administrator-used management consoles.
- Restrict management console access to trusted networks where operationally feasible.
- Review session management controls and invalidate exposed or suspicious sessions.
Validation and detection
- Confirm whether any deployed WSO2 product matches the affected version list.
- Identify who can access Carbon Management Console and Try It functionality.
- Check whether management interfaces are reachable from untrusted networks.
- Review logs for unusual administrator session activity or unexpected outbound destinations.
- Document remediation status against WSO2 advisory WSO2-2020-0687.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-24703 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.