

Security Advisory WSO2-2021-1334

Published: March 08, 2022

Version: 1.0.0

Severity: Low

---

AFFECTED PRODUCTS

• WSO2 API Manager : 4.0.0 , 3.2.0 , 3.1.0 , 3.0.0

OVERVIEW

Information disclosure vulnerability in a REST API resource.

DESCRIPTION

Due to improper error handling, a REST API resource could expose a server side error containing an internal WSO2 specific package name in the HTTP response.

IMPACT

By leveraging the said vulnerability a malicious unauthenticated actor may get visibility of an internal package name. This may be useful for a malicious actor to understand the technical information about the underlying system (specifically the usage of the WSO2 product).

SOLUTION

If the latest version of the affected WSO2 product is not mentioned under the affected product list, you may migrate to the latest version to receive security fixes.

Otherwise, you may apply the relevant fixes to the product based on the public fix(s):

• https://github.com/wso2/carbon-apimgt/pull/10444

Info

If you are a WSO2 customer with a support subscription, use WSO2 Updates in order to apply the fix.