CVE-2022-29464: Improper Limitation of a Pathname to a Restricted Directory

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps...

PT-2020-15754

Name of the Vulnerable Software and Affected Versions WSO2 API Manager versions prior to 3.0.0 WSO2 API Manager Analytics versions 2.2.0 and 2.5.0 WSO2 API Microgateway version 2.2.0 WSO2 Enterprise Integrator versions 6.2.0 and 6.3.0 WSO2 Identity Server Analytics versions prior to 5.6.0...