CVE-2016-4312: XEE

Published Feb 16, 2017

Updated

XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated users with access to XACML features to read arbitrary files, cause a denial of service, conduct server-side request forgery (SSRF) attacks, or have unspecified other impact via a crafted XACML request to entitlement/eval-policy-submit.jsp. NOTE: this issue can be combined with CVE-2016-4311 to exploit the vulnerability without credentials.

Affected Software

1 affected component

WSO2 Identity Server=5.1.0

Remediation

Patch Available

https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2016-0096

Event History

Feb 16, 2017

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Feb 17, 2017

Data Sourced

via NVD·02:59 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2016-4312?

CVE-2016-4312 is considered a critical vulnerability due to its potential for remote access and file reading capabilities.

How do I fix CVE-2016-4312?

To fix CVE-2016-4312, upgrade WSO2 Identity Server to version 5.1.0 with the WSO2-CARBON-PATCH-4.4.0-0231 or later.

What types of attacks can CVE-2016-4312 facilitate?

CVE-2016-4312 can facilitate attacks such as reading arbitrary files, denial of service, and server-side request forgery (SSRF).

Who is affected by CVE-2016-4312?

CVE-2016-4312 affects remote authenticated users with access to the XACML features in WSO2 Identity Server version 5.1.0.

What feature of WSO2 Identity Server is impacted by CVE-2016-4312?

CVE-2016-4312 specifically impacts the XML external entity (XXE) processing within the XACML flow feature.