CA API oAuth Toolkit - Reflected XSS Vulnerability

Products

• CA API Gateway

Issue/Introduction

 

The Symantec Layer7 API Management OAuth Toolkit (OTK) is susceptible to a reflected cross-site scripting (XSS) vulnerability. A remote attacker can craft a malicious URL and target OTK users with phishing attacks or other social engineering techniques. A successful attack allows injecting malicious code into the user’s client browser in one of the OAuth flows.

Environment

Release: Versions of oAuth Toolkit prior to 4.4.x

 

Resolution

If you are running Portal prior to 4.4.x please upgrade to oAauth Toolkit 4.5

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/Reflected-XSS-Vulnerability-in-Layer7-OAuth-Toolkit-OTK-/20170