Security Advisory WSO2-2017-0235

Published: July 10, 2017

Severity: Low


AFFECTED PRODUCTS

  • WSO2 API Manager 2.1.0
  • WSO2 App Manager 1.2.0
  • WSO2 Application Server 5.3.0
  • WSO2 Business Process Server 3.6.0
  • WSO2 Business Rules Server 2.2.0
  • WSO2 Complex Event Processor 4.2.0
  • WSO2 Dashboard Server 2.0.0
  • WSO2 Data Analytics Server 3.1.0
  • WSO2 Elastic Load Balancer 2.1.1
  • WSO2 Enterprise Mobility Manager 2.2.0\
  • WSO2 Enterprise Service Bus 5.0.0
  • WSO2 Governance Registry 5.4.0
  • WSO2 Identity Server 5.3.0
  • WSO2 IoT Server 3.0.0
  • WSO2 Machine Learner 1.2.0

OVERVIEW

A potential vulnerability is detected in the Management Console of the above-listed products that let attackers bypass authentication to view a restricted web page.

DESCRIPTION

With the identified vulnerability, an attacker can modify the file extension in the URL of a web page in the Management Console and view a restricted page without authentication, which should be visible only to authenticated and authorized users.

IMPACT

Attackers can access pages that should be restricted by the administrators of the application. However, the attackers cannot view the content of the webpage, where it loads only the theme of the webpage, not even menu items; hence the risk is minimum.

SOLUTION

The recommended solution is to apply relevant security updates/patches to products which fix the identified vulnerability in affected components.

See below for details on patching or updating the affected component.

Code Product Version Patch
AM WSO2 API Manager 2.1.0 WSO2-CARBON-PATCH-4.4.0-1024
AppM WSO2 App Manager 1.2.0 WSO2-CARBON-PATCH-4.4.0-1003
AS WSO2 Application Server 5.3.0 WSO2-CARBON-PATCH-4.4.0-1013
BPS WSO2 Business Process Server 3.6.0 WSO2-CARBON-PATCH-4.4.0-1020
BRS WSO2 Business Rules Server 2.2.0 WSO2-CARBON-PATCH-4.4.0-1017
CEP WSO2 Complex Event Processor 4.2.0 WSO2-CARBON-PATCH-4.4.0-1021
DAS WSO2 Data Analytics Server 3.1.0 WSO2-CARBON-PATCH-4.4.0-1021
DS WSO2 Dashboard Server 2.0.0 WSO2-CARBON-PATCH-4.4.0-1017
DSS WSO2 Data Services Server 3.5.1 WSO2-CARBON-PATCH-4.4.0-1021
EMM WSO2 Enterprise Mobility Manager 2.2.0 WSO2-CARBON-PATCH-4.4.0-1022
ESB WSO2 Enterprise Service Bus 5.0.0 WSO2-CARBON-PATCH-4.4.0-1020
GREG WSO2 Governance Registry 5.4.0 WSO2-CARBON-PATCH-4.4.0-1025
IoTS WSO2 IoT Server 3.0.0 WSO2-CARBON-PATCH-4.4.0-1024
IS WSO2 Identity Server 5.3.0 WSO2-CARBON-PATCH-4.4.0-1024
ML WSO2 Machine Learner 1.2.0 WSO2-CARBON-PATCH-4.4.0-1021

Info

If you are using newer versions of the products than the ones mentioned in the "SOLUTION" section, this vulnerability is fixed.