{"schemaVersion":3,"id":"CVE-2016-4312","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated users with access to XACML features to read arbitrary files, cause a denial of service, conduct server-side request forgery (SSRF) attacks, or have unspecified other impact via a crafted XACML request to entitlement/eval-policy-submit.jsp.  NOTE: this issue can be combined with CVE-2016-4311 to exploit the vulnerability without credentials.","dates":{"published":"2017-02-16T18:00:00.000Z","modified":"2024-08-06T00:25:14.366Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.0","versionLabel":"v3.0","source":"NVD","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6,"severity":"medium","vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.05997,"percentile":0.93257,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.05997},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.05538,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.05997,"percentile":0.93257}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.05538,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.05997,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.05997,"percentile":0.93257}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_302BA9BA40E7A47F","name":"Exploit Reference (hyp3rlinx.altervista.org)","source":"reference","url":"http://hyp3rlinx.altervista.org/advisories/WSO2-IDENTITY-SERVER-v5.1.0-XML-External-Entity.txt","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_0D165E43AE46948A","name":"Exploit Reference (packetstormsecurity.com)","source":"reference","url":"http://packetstormsecurity.com/files/138329/WSO2-Identity-Server-5.1.0-XML-Injection.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"40239","name":"WSO2 Identity Server 5.1.0 - Multiple Vulnerabilities","source":"exploit-database","url":"https://www.exploit-db.com/exploits/40239","maturity":"poc","reliabilityScore":0.8,"verified":true,"type":null,"platforms":["jsp"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"webapps","platform":"jsp","file":"exploits/jsp/webapps/40239.txt","codes":["CVE-2016-4312","CVE-2016-4311"]},"metasploit":null}],"exploitCount":3,"weaknesses":[{"id":"CWE-611","name":"Improper Restriction of XML External Entity Reference","description":"The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/611.html"}],"affected":[{"vendor":"wso2","product":"identity_server","name":"identity server","label":"identity_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"5.1.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"5.1.0","eol":null,"hubHref":"/vendor/wso2/identity_server"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.exploit-db.com/exploits/40239/","label":"www.exploit-db.com/exploits/40239/","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/archive/1/539199/100/0/threaded","label":"www.securityfocus.com/archive/1/539199/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://www.securityfocus.com/bid/92485","label":"www.securityfocus.com/bid/92485","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]},{"url":"https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2016-0096","label":"docs.wso2.com/display/Security/Security+Advisory+WSO2-2016-0096","hostname":"docs.wso2.com","tags":["X Refsource CONFIRM","Patch","Vendor Advisory"]},{"url":"http://hyp3rlinx.altervista.org/advisories/WSO2-IDENTITY-SERVER-v5.1.0-XML-External-Entity.txt","label":"hyp3rlinx.altervista.org/advisories/WSO2-IDENTITY-SERVER-v5.1.0-XML-External-Entity.txt","hostname":"hyp3rlinx.altervista.org","tags":["X Refsource MISC","Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/138329/WSO2-Identity-Server-5.1.0-XML-Injection.html","label":"packetstormsecurity.com/files/138329/WSO2-Identity-Server-5.1.0-XML-Injection.html","hostname":"packetstormsecurity.com","tags":["X Refsource MISC","Exploit","Third Party Advisory","VDB Entry"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2017-02-16T18:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-06T00:25:14.366Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":41,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T17:14:08.035Z","stale":false,"partial":false}}