Security Advisory WSO2-2017-0183

Published: March 06, 2017


  • WSO2 Application Server 5.3.0
  • WSO2 Data Services Server 3.5.1
  • WSO2 Enterprise Service Bus 5.0.0
  • WSO2 Message Broker 3.1.0


The WSO2 Carbon WSDL Tool of the above-listed products has been identified to have an XSS vulnerability where a user can inject an executable script as user input.


In Carbon WSDL Tool, a reflected XSS attack can be performed when a user injects a malicious executable script as user input through the carbon management console.

This issue has been fixed in the affected component with the security patches given for specific products.


An attacker can include malicious content in a request to Carbon WSDL Tool’s wsdl2code page in the management console, and trick a user to click the malicious content via email or a neutral website. This reflects the attack back to the user's browser and will execute the injected code, which may generate malicious page results that will mislead the victim or harm otherwise.


The recommended solution is to apply relevant security patches which fix the XSS vulnerability identified in the specific components used in products.

See below for details on patching or updating the affected component.

For WSO2 Update Manager (WUM) Supported Products

Use WUM to update the following products.

Code Product Version Patch
AS WSO2 Application Server 5.3.0 WSO2-CARBON-PATCH-4.4.0-0601
DSS WSO2 Data Services Server 3.5.1 WSO2-CARBON-PATCH-4.4.0-0586
ESB WSO2 Enterprise Service Bus 5.0.0 WSO2-CARBON-PATCH-4.4.0-0586
MB WSO2 Message Broker 3.1.0 WSO2-CARBON-PATCH-4.4.0-0600

For Other Products

Apply the following patches based on your products by following the instructions in the README file. Patches can also be downloaded from Security Patch Releases. If you have any questions, post them to

Code Product Version Patch
BPS WSO2 Business Process Server 3.6.0 WSO2-CARBON-PATCH-4.4.0-0611
CEP WSO2 Complex Event Processor 4.2.0 WSO2-CARBON-PATCH-4.4.0-0612
DAS WSO2 Data Analytics Server 3.1.0 WSO2-CARBON-PATCH-4.4.0-0612
ESB WSO2 Enterprise Service Buss 5.0.0 WSO2-CARBON-PATCH-4.4.0-0611
ESB Analytics WSO2 Enterprise Service Bus Analytics 5.0.0 WSO2-CARBON-PATCH-4.4.0-0611


If you are using newer versions of the products than the ones mentioned in the "SOLUTION" section, this vulnerability is fixed.


WSO2 thanks, Marcin Woloszyn for responsibly reporting the identified issues and working with us as we addressed them.