CVE-2016-4312: wso2 identity_server

Vulnerability summary

CVE-2016-4312 is a high (CVSS 7.5) vulnerability in wso2 identity_server. EPSS estimates a 6.00% chance of exploitation in the next 30 days, higher than 93.2% of scored vulnerabilities. 3 public exploits are recorded.

Timeline

1. 16-02-2017
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated users with access to XACML features to read arbitrary files, cause a denial of service, conduct server-side request forgery (SSRF) attacks, or have unspecified other impact via a crafted XACML request to entitlement/eval-policy-submit.jsp. NOTE: this issue can be combined with CVE-2016-4311 to exploit the vulnerability without credentials.

• CWE-611Improper Restriction of XML External Entity ReferenceThe product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.