

Security Advisory WSO2-2022-1770

Published: 2025-03-18

Updated: 2025-03-18

Version: 1.0.0

Severity: High

CVSS Score: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

---

AFFECTED PRODUCTS

• WSO2 API Manager 4.1.0, 4.0.0
• WSO2 Enterprise Integrator 6.6.0
• WSO2 Identity Server 5.11.0

OVERVIEW

Potential Denial of service vulnerability.

DESCRIPTION

Due to the improper map of relative URLs, the host reaches an unavailable state in certain circumstances when SAML2 SSO Authentication is enabled.

IMPACT

By leveraging the identified vulnerability, a malicious actor could impact the availability of host and restrict genuine users access to it for legitimate use cases.

SOLUTION

Community Users (Open Source)

Apply the relevant fixes to your product using the public fix(es) provided below.

• https://github.com/wso2/carbon-identity-framework/pull/1234

If applying the fix or update is not feasible, migrate to the latest unaffected version of the respective WSO2 product(s).

Support Subscription Holders

Update your product to the specified update level—or a higher update level—to apply the fix.

Info

WSO2 Support Subscription Holders may use WSO2 Updates in order to apply the fix.

Product	Version	U2 Update Level
WSO2 API Manager	4.0.0	72
WSO2 API Manager	4.1.0	171
WSO2 Enterprise Integrator	6.6.0	202
WSO2 Identity Server	5.11.0	112