CVE

Id
91131  
CVE No.
CVE-2016-4312  
Status
Candidate  
Description
XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated users with access to XACML features to read arbitrary files, cause a denial of service, conduct server-side request forgery (SSRF) attacks, or have unspecified other impact via a crafted XACML request to entitlement/eval-policy-submit.jsp. NOTE: this issue can be combined with CVE-2016-4311 to exploit the vulnerability without credentials.  
Phase
Assigned (20160427)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
783619 91131 CVE-2016-4312 BUGTRAQ:20160813 WSO2 IDENTITY-SERVER v5.1.0 XML External-Entity  View
783620 91131 CVE-2016-4312 URL:http://www.securityfocus.com/archive/1/archive/1/539199/100/0/threaded  View
783621 91131 CVE-2016-4312 EXPLOIT-DB:40239  View
783622 91131 CVE-2016-4312 URL:https://www.exploit-db.com/exploits/40239/  View
783623 91131 CVE-2016-4312 MISC:http://hyp3rlinx.altervista.org/advisories/WSO2-IDENTITY-SERVER-v5.1.0-XML-External-Entity.txt  View
783624 91131 CVE-2016-4312 MISC:http://packetstormsecurity.com/files/138329/WSO2-Identity-Server-5.1.0-XML-Injection.html  View
783625 91131 CVE-2016-4312 CONFIRM:https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2016-0096  View
783626 91131 CVE-2016-4312 BID:92485  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
3252 JVNDB-2016-004025 Apple OS X の IOSurface における権限を取得される脆弱性 Apple OS X の IOSurface には、解放済みメモリの使用 (Use-after-free) により、権限を取得される脆弱性が存在します。 CVE-2016-4625 91131 7.2 7.8 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-004025.html  View