Crnković

**Name of the Vulnerable Software and Affected Versions** WSO2 products (affected versions not specified) **Description** An arbitrary file upload issue exists due to inadequate validation of uploaded content and destination within SOAP admin services. An attacker with administrative privileges can upload a crafted file to a location they control within the deployment. Successful exploitation could result in remote code execution (RCE) on the server, depending on how the uploaded file is handled. This issue is exploitable only by users with administrative access to the affected SOAP services. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WSO2 products (affected versions not specified) **Description** A reflected cross-site scripting (XSS) issue exists in the authentication endpoints of WSO2 products because of insufficient output encoding. An attacker can inject JavaScript payloads into the authentication endpoint, which are then reflected in the response, potentially leading to browser-based attacks. Exploitation could result in redirection to malicious websites, UI manipulation, or unauthorized data access from the victim’s browser. Session cookies are protected with the httpOnly flag, which limits the risk of session hijacking through this method. The vulnerable endpoints are the authentication endpoints. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WSO2 products (affected versions not specified) **Description** A reflected cross-site scripting (XSS) issue exists in the management console of multiple WSO2 products because of improper output encoding. A malicious actor can inject arbitrary JavaScript into the response by manipulating specific parameters, resulting in reflected XSS. Successful exploitation could lead to UI manipulation, redirection to malicious websites, or data theft from the browser. Session-related sensitive cookies are protected with the httpOnly flag, which reduces the risk of session hijacking. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WSO2 products (affected versions not specified) **Description** An issue exists where the XML parser is improperly configured. The application processes user-provided XML data without adequate restrictions, potentially allowing the resolution of external entities. A remote, unauthenticated attacker could exploit this to read sensitive files from the server or cause a denial-of-service condition. The vulnerability involves improper configuration of the XML parser and the parsing of user-supplied XML data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WSO2 Micro Integrator (affected versions not specified) WSO2 Enterprise Integrator (affected versions not specified) WSO2 API Manager (affected versions not specified) **Description** An arbitrary code execution issue exists due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Authenticated users with elevated privileges can execute arbitrary code within the integration runtime environment. In WSO2 Micro Integrator and WSO2 Enterprise Integrator, access to these scripting engines is limited to administrators by default. In WSO2 API Manager, access extends to both administrators and API creators. This may allow trusted-but-privileged users to perform unauthorized actions or compromise the execution environment. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WSO2 products (affected versions not specified) **Description** An improper access control issue exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. This allows a low-privileged user to perform unauthorized operations, including accessing server-level information. The vulnerability affects only internal administrative interfaces and does not impact APIs exposed through the WSO2 API Manager's API Gateway. The vulnerability allows unauthorized access to server information through internal SOAP Admin Services. The issue stems from insufficient permission enforcement within internal SOAP Admin Services and System REST APIs. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WSO2 API Manager (affected versions not specified) **Description** An improper privilege management issue exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint. A malicious user can exploit this flaw to generate access tokens with elevated privileges, potentially leading to administrative access and the ability to perform unauthorized operations. The affected endpoint is `/keymanager-operations/DCR`. The vulnerable operation involves generating access tokens. The `access tokens` are generated with elevated privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.