Security Advisory WSO2-2017-0235

Published: July 10th, 2017

Severity: Low

AFFECTED PRODUCTS

WSO2 API Manager 2.1.0

WSO2 App Manager 1.2.0

WSO2 Application Server 5.3.0

WSO2 Business Process Server 3.6.0

WSO2 Business Rules Server 2.2.0

WSO2 Complex Event Processor 4.2.0

WSO2 Dashboard Server 2.0.0

WSO2 Data Analytics Server  3.1.0

WSO2 Elastic Load Balancer 2.1.1

WSO2 Enterprise Mobility Manager 2.2.0\

WSO2 Enterprise Service Bus 5.0.0

WSO2 Governance Registry 5.4.0

WSO2 Identity Server 5.3.0

WSO2 IoT Server 3.0.0

WSO2 Machine Learner 1.2.0

OVERVIEW

A potential vulnerability is detected in the Management Console of the above listed products that lets attackers bypass authentication to view a restricted web page.

DESCRIPTION

With the identified vulnerability, an attacker can modify the file extension in the URL of a web page in Management Console and view a restricted page without authentication, which should be visible only to authenticated and authorized users.

IMPACT 

Attackers can access pages that should be restricted by the administrators of the application. However the attackers cannot view the content of the web page, where it loads only the theme of the web page not even menu items; hence the risk is minimum.

SOLUTION

The recommended solution is to apply relevant security updates/patches to products which fix the identified vulnerability in affected components.

Please see below for details on patching or updating the affected component.

NOTES

If you are using newer versions of the products than the ones mentioned in the “SOLUTION” section, this vulnerability is fixed.