PT-2022-2550 · Wso2 · Wso2 Enterprise Integrator+8

Published 2022-04-01 · Updated 2023-11-03 · CVE-2022-29548

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WSO2 API Manager versions 2.2.0 through 4.0.0 WSO2 API Manager Analytics versions 2.2.0 through 2.6.0 WSO2 API Microgateway version 2.2.0 WSO2 Data Analytics Server version 3.2.0 WSO2 Enterprise Integrator versions 6.2.0 through 6.6.0 WSO2 IS as Key Manager versions 5.5.0 through 5.10.0 WSO2 Identity Server versions 5.5.0 through 5.11.0 WSO2 Identity Server Analytics versions 5.5.0 through 5.6.0 WSO2 Micro Integrator version 1.0.0

Description A reflected XSS issue exists in the Management Console of several WSO2 products. This issue is related to the lack of protection of the web page structure, which may allow a remote attacker to perform cross-site scripting attacks.

Recommendations For WSO2 API Manager versions 2.2.0 through 4.0.0, update to a version that includes the fix for this issue. For WSO2 API Manager Analytics versions 2.2.0 through 2.6.0, update to a version that includes the fix for this issue. For WSO2 API Microgateway version 2.2.0, update to a version that includes the fix for this issue. For WSO2 Data Analytics Server version 3.2.0, update to a version that includes the fix for this issue. For WSO2 Enterprise Integrator versions 6.2.0 through 6.6.0, update to a version that includes the fix for this issue. For WSO2 IS as Key Manager versions 5.5.0 through 5.10.0, update to a version that includes the fix for this issue. For WSO2 Identity Server versions 5.5.0 through 5.11.0, update to a version that includes the fix for this issue. For WSO2 Identity Server Analytics versions 5.5.0 through 5.6.0, update to a version that includes the fix for this issue. For WSO2 Micro Integrator version 1.0.0, update to a version that includes the fix for this issue. As a temporary workaround, consider disabling access to the Management Console until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-02973

CVE-2022-29548

Affected Products

Wso2 Api Manager

Wso2 Api Manager Analytics

Wso2 Api Microgateway

Wso2 Data Analytics Server

Wso2 Enterprise Integrator

Wso2 Is As Key Manager

Wso2 Identity Server

Wso2 Identity Server Analytics

Wso2 Micro Integrator

References · 11

• 🔥 https://github.com/cxosmo/CVE-2022-29548 · Exploit
• 🔥 http://packetstormsecurity.com/files/167587/WSO2-Management-Console-Cross-Site-Scripting.html · Exploit
• 🔥 https://exploit-db.com/exploits/50970 · Exploit
• https://osv.dev/vulnerability/CVE-2022-29548 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02973 · Security Note
• https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1603 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29548 · Security Note
• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1603 · Note
• https://t.me/cvenotify/39018 · Telegram Post
• https://vuldb.com/?id.198285 · Note
• https://t.me/cvenotify/29262 · Telegram Post