PT-2019-18131 · Wso2 · Wso2 Api Manager

Julien Oury–Nogues · Publicado 2019-05-21 · Atualizado 2019-05-23 · CVE-2019-6513

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions WSO2 API Manager version 2.6.0

Description An issue was discovered that allows a logged-in user to upload any type of file as API documentation by changing the file extension to an allowed one.

Recommendations For WSO2 API Manager version 2.6.0, consider restricting file uploads to only necessary file types to minimize the risk of exploitation. As a temporary workaround, implement additional validation checks on uploaded files to ensure they match the expected file type based on the extension.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-6513

Produtos afetados

Wso2 Api Manager

Referências · 5

• https://cds.thalesgroup.com/en/tcs-cert/CVE-2019-6513 · Nota
• https://excellium-services.com/cert-xlm-advisory/cve-2019-6513 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-6513 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-6513 · Aviso do Fabricante
• https://excellium-services.com/cert-xlm-advisory · Nota