CVE-2016-4314: Path Traversal

Q: What is the severity of CVE-2016-4314?

CVE-2016-4314 is classified as a high severity vulnerability due to its ability to allow unauthorized file access.

Q: How do I fix CVE-2016-4314?

To remediate CVE-2016-4314, upgrade WSO2 Carbon to version 4.4.6 or a later version where this vulnerability is addressed.

Q: Who is affected by CVE-2016-4314?

Any remote authenticated administrators using WSO2 Carbon version 4.4.5 are affected by CVE-2016-4314.

Q: What type of vulnerability is CVE-2016-4314?

CVE-2016-4314 is a directory traversal vulnerability that allows access to arbitrary files on the server.

Q: What is the impact of CVE-2016-4314?

The impact of CVE-2016-4314 includes potential disclosure of sensitive information from the filesystem.

Published Feb 16, 2017

Updated

Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the logFile parameter to downloadgz-ajaxprocessor.jsp.

Affected Software

2 affected components

WSO2 Carbon=4.4.5

maven/org.wso2.carbon.commons:org.wso2.carbon.logging.view.ui<=4.4.5

Remediation

Patch Available

https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2016-0098

Event History

Feb 16, 2017

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Feb 17, 2017

Data Sourced

via NVD·02:59 AM

RemedyDescriptionSeverityWeaknessAffected Software

May 14, 2022

Advisory Published

via GitHub·02:46 AM

Frequently Asked Questions

What is the severity of CVE-2016-4314?

CVE-2016-4314 is classified as a high severity vulnerability due to its ability to allow unauthorized file access.

How do I fix CVE-2016-4314?

To remediate CVE-2016-4314, upgrade WSO2 Carbon to version 4.4.6 or a later version where this vulnerability is addressed.

Who is affected by CVE-2016-4314?