Security Advisory WSO2-2016-0140

Published: September 30, 2016


AFFECTED PRODUCTS

  • WSO2 API Manager 2.0.0
  • WSO2 Message Broker 3.1.0

OVERVIEW

The carbon Metrics UI of the above WSO2 products is vulnerable to reflected XSS attacks.

DESCRIPTION

Several XSS vulnerabilities were discovered in the Carbon Metrics component of WSO2 products. An attacker can possibly attack the management console, via that component, using reflected XSS. He can inject malicious scripts as a part of the URL which will be reflected in that component's pages.

IMPACT

An attacker aware of the management console origin can include malicious content in a request to Carbon Metrics UI pages, and trick a user to click the malicious content via email or a neutral website. This reflects the attack back to the user's browser and will execute the injected code, which may generate malicious page results that will mislead the victim or harm otherwise.

SOLUTION

Apply the following patches based on your products by following the instructions in the README file. Patches can also be downloaded from Security Patch Releases. If you have any questions, post them to security@wso2.com.

Code Product Version Patch
AM WSO2 API Manager 2.0.0 WSO2-CARBON-PATCH-4.4.0-0370
MB WSO2 Message Broker 3.1.0 WSO2-CARBON-PATCH-4.4.0-0370

Info

If you are using newer versions of the products than the ones mentioned in the "SOLUTION" section, this vulnerability is fixed.