CVSS: 8.5EPSS: 0%CPEs: 26EXPL: 0CVE-2023-6837
https://notcve.org/view.php?id=CVE-2023-6837
Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. In order for this vulnerability to have any impact on your deployment, following conditions must be met: * An IDP configured for federated authentication and JIT provisioning enabled with the "Prompt for username, password and consent" option. * A service provider that uses the above IDP for federated authentication and has the "Assert identity using mapped local subject identifier" flag enabled. Attacker should have: * A fresh valid user account in the federated IDP that has not been used earlier. * Knowledge of the username of a valid user in the local IDP. When all preconditions are met, a malicious actor could use JIT provisioning flow to perform user impersonation. Se han identificado varios productos WSO2 como vulnerables para realizar suplantaciones de usuarios mediante el aprovisionamiento JIT. Para que esta vulnerabilidad tenga algún impacto en su implementación, se deben cumplir las siguientes condiciones: * Un IDP configurado para autenticación federada y aprovisionamiento JIT habilitado con la opción "Solicitar nombre de usuario, contraseña y consentimiento". * Un proveedor de servicios que utiliza el IDP anterior para la autenticación federada y tiene habilitada la opción "Afirmar identidad utilizando un identificador de sujeto local asignado". El atacante debe tener: * Una cuenta de usuario nueva y válida en el IDP federado que no se haya utilizado anteriormente. * Conocimiento del nombre de usuario de un usuario válido en el IDP local. • https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1573 •
CVSS: 9.1EPSS: 3%CPEs: 13EXPL: 0CVE-2021-42646
https://notcve.org/view.php?id=CVE-2021-42646
XML External Entity (XXE) vulnerability in the file based service provider creation feature of the Management Console in WSO2 API Manager 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; and WSO2 IS as Key Manager 5.7.0, 5.9.0, and 5.10.0; and WSO2 Identity Server 5.7.0, 5.8.0, 5.9.0, 5.10.0, and 5.11.0. Allows attackers to gain read access to sensitive information or cause a denial of service via crafted GET requests. Una vulnerabilidad de tipo XML External Entity (XXE) en la función de creación de proveedores de servicios basados en archivos de la Consola de Administración en WSO2 API Manager versiones 2.6.0, 3.0.0, 3.1.0, 3.2.0 y 4.0.0; y WSO2 IS as Key Manager versiones 5.7.0, 5.9.0 y 5.10.0; y WSO2 Identity Server versiones 5.7.0, 5.8.0, 5.9.0, 5.10.0 y 5.11.0. Permite a atacantes conseguir acceso de lectura a información confidencial o causar una denegación de servicio por medio de peticiones GET diseñadas • http://packetstormsecurity.com/files/167465/WSO2-Management-Console-XML-Injection.html http://seclists.org/fulldisclosure/2022/Jun/7 https://github.com/wso2/carbon-identity-framework/pull/3472 https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2021-1289 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 6.1EPSS: 2%CPEs: 31EXPL: 3CVE-2022-29548 – WSO2 Management Console (Multiple Products) - Unauthenticated Reflected Cross-Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2022-29548
A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0, 6.5.0, and 6.6.0; IS as Key Manager 5.5.0, 5.6.0, 5.7.0, 5.9.0, and 5.10.0; Identity Server 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0, and 5.11.0; Identity Server Analytics 5.5.0 and 5.6.0; and WSO2 Micro Integrator 1.0.0. Se presenta un problema de tipo XSS reflejado en la Consola de Administración de varios productos WSO2. Esto afecta a API Manager versiones 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0 y 4.0.0; API Manager Analytics versiones 2.2.0, 2.5.0 y 2.6.0; API Microgateway versión 2.2.0; Data Analytics Server versión 3.2.0; Enterprise Integrator versiones 6.2.0, 6.3.0, 6.4. 0, 6.5.0 y 6.6.0; IS as Key Manager versiones 5.5.0, 5.6.0, 5.7.0, 5.9.0 y 5.10.0; Identity Server versiones 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0 y 5.11.0; Identity Server Analytics versiones 5.5.0 y 5.6.0; y WSO2 Micro Integrator versión 1.0.0 WSO2 Management Console suffers from a cross site scripting vulnerability. Many different product versions are affected. • https://www.exploit-db.com/exploits/50970 https://github.com/cxosmo/CVE-2022-29548 http://packetstormsecurity.com/files/167587/WSO2-Management-Console-Cross-Site-Scripting.html https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1603 https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1603 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 97%CPEs: 11EXPL: 25CVE-2022-29464 – WSO2 Multiple Products Unrestrictive Upload of File Vulnerability
https://notcve.org/view.php?id=CVE-2022-29464
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0. Algunos productos WSO2 permiten la carga de archivos sin restricciones con la consiguiente ejecución remota de código. • https://github.com/hakivvi/CVE-2022-29464 https://github.com/electr0lulz/Mass-exploit-CVE-2022-29464 https://github.com/Inplex-sys/CVE-2022-29464-loader https://github.com/ThatNotEasy/CVE-2022-29464 https://github.com/gpiechnik2/nmap-CVE-2022-29464 https://github.com/r4x0r1337/-CVE-2022-29464 https://github.com/superzerosec/CVE-2022-29464 https://github.com/gbrsh/CVE-2022-29464 https://github.com/xinghonghaoyue/CVE-2022-29464 https://github.com/amit-pathak009/CVE-2022-294 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 16EXPL: 0CVE-2021-36760
https://notcve.org/view.php?id=CVE-2021-36760
In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL that precedes the callback parameter. Once the username or password reset procedure is completed, the JavaScript code will be executed. (recoverpassword.do also has an open redirect issue for a similar reason.) En el archivo accountrecoveryendpoint/recoverpassword.do en WSO2 Identity Server versión 5.7.0, es posible llevar a cabo un ataque de tipo XSS basado en DOM que afecta al parámetro callback modificando la URL que precede al parámetro callback. Una vez que el procedimiento de restablecimiento del nombre de usuario o de la contraseña ha sido completado, el código JavaScript será ejecutado. • https://docs.wso2.com/display/Security/2021+Advisories https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1314 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •