/
Security Advisory WSO2-2019-0486
com.atlassian.confluence.content.render.xhtml.migration.exceptions.UnknownMacroMigrationException: The macro 'next_previous_links' is unknown.

Security Advisory WSO2-2019-0486

Nov 04, 2019

Published: 04th Novemeber 2019

Severity: Medium

CVSS Score: 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)


AFFECTED PRODUCTS

WSO2 API Manager


OVERVIEW

A potential Unvalidated Redirect vulnerability has been identified in the web app info page (Web app listing) of the carbon console.

DESCRIPTION

Open Redirect vulnerability is discovered in the web app info page, where the page will be redirected directly to the URL using the 'defaultHostname' in the request payload which can be a malicious one.


IMPACT

An attacker can modify the 'defaultHostname' to a hostname value of a malicious site, and trick a user to invoke the modified URL. This redirects the user to the malicious site and the attacker may successfully launch a phishing scam and steal user credentials or other sensitive information.

SOLUTION

The recommended solution is to remove 'org.wso2.carbon.webapp.list.ui' jar file from  <API-M_HOME>/repository/components/plugins.

NOTES

If you are using newer versions of affected products than the ones mentioned in the “SOLUTION” section, this vulnerability is fixed. 

It is highly recommended to migrate older versions of the WSO2 products to the latest released version to receive security fixes.


com.atlassian.confluence.content.render.xhtml.migration.exceptions.UnknownMacroMigrationException: The macro 'next_previous_links2' is unknown.