Vulnerability Reporting Guidelines¶
Version: 1.7
This page describes how to prepare and submit a security vulnerability report for a WSO2 product, service, or open-source project: what to do before reporting, the disclosure rules, and what to include in the report. The submission channels (mailing lists, Support Portal) are documented in Report Security Issues. WSO2's internal handling of the report (triage, resolution timelines, advisory publication) is documented in Vulnerability Management Process.
Check the Security Advisories page first; the issue you have found may already be disclosed and patched.
Before reporting¶
If you intend to run an automated scan or a penetration test against a WSO2 product, prepare the test environment first. Many findings against an unhardened or out-of-date deployment are deployment misconfigurations rather than product vulnerabilities.
- Apply the Security Guidelines for Production Deployment.
- If you hold a WSO2 subscription, install the latest security updates.
- Test against the latest released product version listed in the WSO2 Support Matrix.
- If you intend to submit a finding for reward consideration, read the Reward and Acknowledgement Program for in-scope products, non-qualifying categories, and the reward tiers.
Submitting the report¶
Submit through one of the channels documented in Report Security Issues.
Warning
Do not report vulnerabilities through any other medium: public GitHub repositories, public forums, blogs, social media, or public or private chat groups. Do not share vulnerability details with anyone else before WSO2 has completed mitigation. WSO2 keeps the reporter informed throughout the process.
What to include in the report¶
- The vulnerable WSO2 product, project, or service, and its version where applicable.
- A high-level overview of the issue.
- The affected URL(s) and parameter(s), where applicable.
- Browser, operating system, or application version, where applicable.
- Steps to reproduce; a screencast is welcome.
- Self-assessed severity and impact.
- Any proposed mitigation or solution.