/
Security Advisory WSO2-2016-0135
com.atlassian.confluence.content.render.xhtml.migration.exceptions.UnknownMacroMigrationException: The macro 'next_previous_links' is unknown.

Security Advisory WSO2-2016-0135

Owned by Former user (Deleted)

Published: 8th November 2016


AFFECTED PRODUCTS

WSO2 API Manager 2.0.0
WSO2 App Manager 1.2.0
WSO2 Application Server 5.3.0
WSO2 Business Rules Server 2.1.0
WSO2 Dashboard Server 2.0.0
WSO2 Message Broker 3.1.0


OVERVIEW


An Open Redirect vulnerability is discovered in the Carbon Management Console.

 

DESCRIPTION

Following pages in the management console were found to be vulnerable to open redirect attacks, in the products mentioned here.

  • XACML Policy Administration

  • Identity Provider Management

  • Workflow Management

  • User Management

An attacker can possibly attack the above UI components, by modifying some query parameters that contain a URL value in management console context. They can modify the respective query parameter value such that the management console will redirect the request to the specified URL.


IMPACT

An attacker aware of the management console origin, can modify the query parameter values to a URL value of a malicious site, and trick a user to invoke the modified URL via email or a neutral web site. This redirects the user to the malicious site and the attacker may successfully launch a phishing scam and steal user credentials or other sensitive information, or harm in any other way.


SOLUTION

For WSO2 Update Manager (WUM) Supported Products

Please use WUM to update the following products.


Code

Product

Version

AM

WSO2 API Manager

2.0.0 


For Other Products

Apply the following patches based on your product version by following the instructions in the README file. If you have any questions, post them to security@wso2.com.

Please download the relevant patches based on the products you use following the matrix below. Patches can also be downloaded from http://wso2.com/security-patch-releases/.

 


Code

Product

Version

Patch

APPM

WSO2 App Manager

1.2.0

WSO2-CARBON-PATCH-4.4.0-0552

AS

WSO2 Application Server

5.3.0

WSO2-CARBON-PATCH-4.4.0-0553

DS

WSO2 Dashboard Server

2.0.0

WSO2-CARBON-PATCH-4.4.0-0555

ES

WSO2 Enterprise Store

2.0.0

WSO2-CARBON-PATCH-4.4.0-0556

MB

WSO2 Message Broker

3.1.0

WSO2-CARBON-PATCH-4.4.0-0556


NOTES

If you are using newer versions of the products than the ones mentioned in the “SOLUTION” section, this vulnerability is fixed. 

  

Thanks,

WSO2 Team

Related content

com.atlassian.confluence.content.render.xhtml.migration.exceptions.UnknownMacroMigrationException: The macro 'next_previous_links2' is unknown.