CVE-2016-4311: CSRF

Published Feb 16, 2017

Updated

Cross-site request forgery (CSRF) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 allows remote attackers to hijack the authentication of privileged users for requests that process XACML requests via an entitlement/eval-policy-submit.jsp request.

Affected Software

1 affected component

WSO2 Identity Server=5.1.0

Remediation

Patch Available

https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2016-0096

Event History

Feb 16, 2017

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Feb 17, 2017

Data Sourced

via NVD·02:59 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2016-4311?

The severity of CVE-2016-4311 is classified as medium due to its ability to allow remote attackers to hijack authentication of privileged users.

How do I fix CVE-2016-4311?

To fix CVE-2016-4311, it is recommended to upgrade to a patched version of WSO2 Identity Server that addresses the CSRF vulnerability.

Which versions of WSO2 Identity Server are affected by CVE-2016-4311?

CVE-2016-4311 affects WSO2 Identity Server version 5.1.0.

What types of attacks can CVE-2016-4311 facilitate?

CVE-2016-4311 can facilitate cross-site request forgery (CSRF) attacks, allowing unauthorized actions on behalf of a privileged user.

Is CVE-2016-4311 a client-side or server-side vulnerability?

CVE-2016-4311 is a server-side vulnerability that affects the authentication mechanism in WSO2 Identity Server.