PT-2019-18130 · Wso2 · Wso2 Api Manager

Publicado 2019-05-14 · Atualizado 2019-05-14 · CVE-2019-6512

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WSO2 API Manager version 2.6.0

Description An issue in WSO2 API Manager allows forcing the application to perform requests to the internal workstation, enabling SSRF port-scanning, or to adjacent workstations for SSRF network scanning. It also allows file enumeration due to the existence of the file:// wrapper.

Recommendations For WSO2 API Manager version 2.6.0, consider restricting access to the file:// wrapper as a temporary workaround until a patch is available. Additionally, restrict the application's ability to perform requests to internal or adjacent workstations to minimize the risk of SSRF exploitation.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2019-6512

Produtos afetados

Wso2 Api Manager

Referências · 5

• https://excellium-services.com/cert-xlm-advisory · Nota
• https://cds.thalesgroup.com/en/tcs-cert/CVE-2019-6512 · Nota
• https://wso2.com/security-patch-releases/api-manager · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-6512 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-6512 · Aviso do Fabricante