Security Advisory WSO2-2019-0571¶
Published: November 04, 2019
CVSS Score: 4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
- WSO2 Enterprise Integrator
Providing users with an option to disable the try-it functionality.
If the try-it service is exposed publicly without authentication, it leads to facilitate Server Side Request Forgery (SSRF) attacks.
An attacker can leverage SSRF to access services.
Upgrade the product to 6.5.0 or a higher version, which is not affected by this SSRF vulnerability. If you have any questions, post them to firstname.lastname@example.org.
It is highly recommended to migrate older versions of the WSO2 products to the latest released version to receive security fixes.
WSO2 thanks, Soner Soydinc for responsibly reporting the identified issue and working with us as we addressed them.