Security Advisory WSO2-2021-1334¶
Published: March 08, 2022
- WSO2 API Manager : 4.0.0 , 3.2.0 , 3.1.0 , 3.0.0
Information disclosure vulnerability in a REST API resource.
Due to improper error handling, a REST API resource could expose a server side error containing an internal WSO2 specific package name in the HTTP response.
By leveraging the said vulnerability a malicious unauthenticated actor may get visibility of an internal package name. This may be useful for a malicious actor to understand the technical information about the underlying system (specifically the usage of the WSO2 product).
If the latest version of the affected WSO2 product is not mentioned under the affected product list, you may migrate to the latest version to receive security fixes.
Otherwise, you may apply the relevant fixes to the product based on the public fix(s):
If you are a WSO2 customer with a support subscription, use WSO2 Updates in order to apply the fix.