Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 allows remote attackers to hijack the authentication of privileged users for requests that process XACML requests via an entitlement/eval-policy-submit.jsp request...

CVE-2016-4312

XML external entity XXE vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated users with access to XACML features to read arbitrary files, cause a denial of service, conduct server-side request forgery SSRF attacks, o...

CVE-2016-4311

CVE-2016-4311 is a CSRF vulnerability in the XACML flow feature of WSO2 Identity Server 5.1.0. The issue allows remote attackers to hijack the authentication of privileged users by crafting requests to entitlement/eval-policy-submit.jsp that process XACML requests. Public references note an in-th...

CVE-2016-4312

CVE-2016-4312 affects WSO2 Identity Server 5.1.0 prior to WSO2-CARBON-PATCH-4.4.0-0231. The issue is an XML External Entity (XXE) vulnerability in the XACML flow feature that allows remote authenticated users with XACML access to read arbitrary files, cause a denial of service, perform SSRF, or i...

WSO2 Carbon Products Detection (HTTP)

HTTP based detection of WSO2 Carbon products. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

WSO2 Identity Server CSRF And XXE Vulnerabilities

WSO2 Identity Server is prone to a XML external entity XXE vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Multiple Vulnerabilities in WSO2 Identity Server

WSO2 Identity Server is a U.S. WSO2 company's open source identity services , it supports Information Cards, OpenID and XACML identity framework. A cross-site request forgery vulnerability and an information disclosure vulnerability exist in WSO2 Identity Server version 5.1.0. An attacker could...

Multiple Vulnerabilities in WSO2 Identity Server (CNVD-2016-06403)

WSO2 Identity Server is a U.S. WSO2 company's open source identity services , it supports Information Cards, OpenID and XACML identity framework. A cross-site request forgery vulnerability and an information disclosure vulnerability exist in WSO2 Identity Server version 5.1.0. An attacker could...

WSO2 Identity Server 5.1.0 - Multiple Vulnerabilities

WSO2 Identity Server 5.1.0 - Multiple Vulnerabilities + Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WSO2-IDENTITY-SERVER-v5.1.0-XML-External-Entity.txt + ISR: ApparitionSec Vendor: ============= www.wso2.com Product:...

WSO2 Identity Server 5.1.0 - Multiple Vulnerabilities

Exploit for jsp platform in category web applications + Credits: John Page aka HYP3RLINX Vendor: ============= www.wso2.com Product: ============================ Wso2 Identity Server v5.1.0 As the industry’s first enterprise identity bus EIB, WSO2 Identity Server is the central backbone that...

WSO2 Identity Server 5.1.0 - Multiple Vulnerabilities

Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WSO2-IDENTITY-SERVER-v5.1.0-XML-External-Entity.txt + ISR: ApparitionSec Vendor: ============= www.wso2.com Product: ============================ Wso2 Identity Server v5.1.0...

WSO2 Identity Server 5.1.0 XML Injection

Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WSO2-IDENTITY-SERVER-v5.1.0-XML-External-Entity.txt + ISR: ApparitionSec Vendor: ============= www.wso2.com Product: ============================ Wso2 Identity Server v5.1.0...

WSO2 Identity Server Cross-Site Scripting Vulnerability

WSO2 Identity Server is an open source identity service that supports Information Cards, OpenID and XACML identity frameworks. WSO2 Identity Server suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code,...

WSO2 Identity Server SAML Authentication XXE Injection Vulnerability

WSO2 Identity Server is an open source identity services , support for Information Cards, OpenID and XACML. WSO2 Identity Server SAML authentication interface XXE injection vulnerability allows remote attackers to submit special XML data to access arbitrary files...

WSO2 Identity Server /carbon/user/add-finish.jsp User Cross-Site Request Forgery Vulnerability

WSO2 Identity Server is an open source identity services , support for Information Cards, OpenID and XACML. WSO2 Identity Server /carbon/user/add-finish.jsp has a cross-site request forgery vulnerability that allows remote attackers to construct malicious URIs, entice users to parse them, and...

WSO2 Identity Server /carbon/user/change-passwd.jsp Cross-Site Scripting Vulnerability

WSO2 Identity Server is an open source identity services , support for Information Cards, OpenID and XACML. WSO2 Identity Server /carbon/user/change-passwd.jsp cross-site scripting vulnerability allows remote attackers to exploit the vulnerability by injecting malicious script or HTML code, which...

SEC Consult SA-20150513-0 :: Multiple critical vulnerabilities in WSO2 Identity Server

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20150513-0 ======================================================================= title: Multiple critical vulnerabilities product: WSO2 Identity Server other WSO2 Carbon based products may be affected...

XSS, CSRF Vulnerabilities identitified in WSO2 Identity Server

A handful of vulnerabilities have been identified in WSO2 Identity Server that could lead to takeover, firewall bypass, and potentially expose subsequent internal servers to further attacks. The open source server software helps developers manage identities and keep track of web apps, services an...

WSO2 Identity Server 5.0.0 XSS / CSRF / XXE Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple critical vulnerabilities product: WSO2 Identity Server other WSO2 Carbon based products may be affected too...

WSO2 Identity Server multiple vulnerabilities

Hi, WSO2 Identity Server http://wso2.com/products/identity-server/ version 4.5.0/4.6.0/5.0.0 is prone to multiple vulnerabilities, including authentication bypass. Timeline: 09.10.2014 - Vendor notified 22.11.2014 - Vendor confirmed 04.12.2014 - Patches released 25.03.2015 - Bugtraq disclosure...