Security Advisory WSO2-2017-0235¶
Published: July 10, 2017
Severity: Low
AFFECTED PRODUCTS¶
- WSO2 API Manager 2.1.0
- WSO2 App Manager 1.2.0
- WSO2 Application Server 5.3.0
- WSO2 Business Process Server 3.6.0
- WSO2 Business Rules Server 2.2.0
- WSO2 Complex Event Processor 4.2.0
- WSO2 Dashboard Server 2.0.0
- WSO2 Data Analytics Server 3.1.0
- WSO2 Elastic Load Balancer 2.1.1
- WSO2 Enterprise Mobility Manager 2.2.0\
- WSO2 Enterprise Service Bus 5.0.0
- WSO2 Governance Registry 5.4.0
- WSO2 Identity Server 5.3.0
- WSO2 IoT Server 3.0.0
- WSO2 Machine Learner 1.2.0
OVERVIEW¶
A potential vulnerability is detected in the Management Console of the above-listed products that let attackers bypass authentication to view a restricted web page.
DESCRIPTION¶
With the identified vulnerability, an attacker can modify the file extension in the URL of a web page in the Management Console and view a restricted page without authentication, which should be visible only to authenticated and authorized users.
IMPACT¶
Attackers can access pages that should be restricted by the administrators of the application. However, the attackers cannot view the content of the webpage, where it loads only the theme of the webpage, not even menu items; hence the risk is minimum.
SOLUTION¶
The recommended solution is to apply relevant security updates/patches to products which fix the identified vulnerability in affected components.
See below for details on patching or updating the affected component.
| Code | Product | Version | Patch |
|---|---|---|---|
| AM | WSO2 API Manager | 2.1.0 | WSO2-CARBON-PATCH-4.4.0-1024 |
| AppM | WSO2 App Manager | 1.2.0 | WSO2-CARBON-PATCH-4.4.0-1003 |
| AS | WSO2 Application Server | 5.3.0 | WSO2-CARBON-PATCH-4.4.0-1013 |
| BPS | WSO2 Business Process Server | 3.6.0 | WSO2-CARBON-PATCH-4.4.0-1020 |
| BRS | WSO2 Business Rules Server | 2.2.0 | WSO2-CARBON-PATCH-4.4.0-1017 |
| CEP | WSO2 Complex Event Processor | 4.2.0 | WSO2-CARBON-PATCH-4.4.0-1021 |
| DAS | WSO2 Data Analytics Server | 3.1.0 | WSO2-CARBON-PATCH-4.4.0-1021 |
| DS | WSO2 Dashboard Server | 2.0.0 | WSO2-CARBON-PATCH-4.4.0-1017 |
| DSS | WSO2 Data Services Server | 3.5.1 | WSO2-CARBON-PATCH-4.4.0-1021 |
| EMM | WSO2 Enterprise Mobility Manager | 2.2.0 | WSO2-CARBON-PATCH-4.4.0-1022 |
| ESB | WSO2 Enterprise Service Bus | 5.0.0 | WSO2-CARBON-PATCH-4.4.0-1020 |
| GREG | WSO2 Governance Registry | 5.4.0 | WSO2-CARBON-PATCH-4.4.0-1025 |
| IoTS | WSO2 IoT Server | 3.0.0 | WSO2-CARBON-PATCH-4.4.0-1024 |
| IS | WSO2 Identity Server | 5.3.0 | WSO2-CARBON-PATCH-4.4.0-1024 |
| ML | WSO2 Machine Learner | 1.2.0 | WSO2-CARBON-PATCH-4.4.0-1021 |
Info
If you are using newer versions of the products than the ones mentioned in the "SOLUTION" section, this vulnerability is fixed.