PT-2020-13382 · Wso2 · Wso2 Api Manager

Published 2020-05-20 · Updated 2022-05-24 · CVE-2020-13226

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WSO2 API Manager version 3.0.0

Description The issue allows for improper restriction of outbound network access from a Publisher node, potentially leading to Server-Side Request Forgery (SSRF) attacks on the node's entire intranet.

Recommendations For WSO2 API Manager version 3.0.0, restrict outbound network access from the Publisher node to prevent SSRF attacks. As a temporary workaround, consider limiting access to the Publisher node to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2020-13226

GHSA-JFGP-Q2HG-W285

Affected Products

Wso2 Api Manager

References · 9

• https://docs.wso2.com/display/Security/Security+Advisories · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jfgp-q2hg-w285 · Vendor Advisory
• https://docs.wso2.com/display/Security/WSO2+Security+Vulnerability+Management+Process · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13226 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13226 · Vendor Advisory
• https://github.com/wso2/product-apim/issues/7677 · Note
• https://github.com/wso2/product-apim · Note
• https://github.com/wso2/docs-apim/issues/816 · Note
• https://t.me/cvenotify/3930 · Telegram Post