Skip to content

Vulnerability Reporting Guidelines

Version: 1.7


This page describes how to prepare and submit a security vulnerability report for a WSO2 product, service, or open-source project: what to do before reporting, the disclosure rules, and what to include in the report. The submission channels (mailing lists, Support Portal) are documented in Report Security Issues. WSO2's internal handling of the report (triage, resolution timelines, advisory publication) is documented in Vulnerability Management Process.

Check the Security Advisories page first; the issue you have found may already be disclosed and patched.

Before reporting

If you intend to run an automated scan or a penetration test against a WSO2 product, prepare the test environment first. Many findings against an unhardened or out-of-date deployment are deployment misconfigurations rather than product vulnerabilities.

Submitting the report

Submit through one of the channels documented in Report Security Issues.

Warning

Do not report vulnerabilities through any other medium: public GitHub repositories, public forums, blogs, social media, or public or private chat groups. Do not share vulnerability details with anyone else before WSO2 has completed mitigation. WSO2 keeps the reporter informed throughout the process.

What to include in the report

  • The vulnerable WSO2 product, project, or service, and its version where applicable.
  • A high-level overview of the issue.
  • The affected URL(s) and parameter(s), where applicable.
  • Browser, operating system, or application version, where applicable.
  • Steps to reproduce; a screencast is welcome.
  • Self-assessed severity and impact.
  • Any proposed mitigation or solution.