CVE-2016-4314 WSO2 Carbon directory traversal vulnerability
MediumCVSS 4.9
EPSS 12.4%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the logFile parameter to downloadgz-ajaxprocessor.jsp.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.wso2.carbon.commons/org.wso2.carbon.logging.view.ui(Maven) | <= 4.4.5 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.logging.view.ui(Maven) | = 4.3.0 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.logging.view.ui(Maven) | = 4.3.1 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.logging.view.ui(Maven) | = 4.3.2 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.logging.view.ui(Maven) | = 4.3.3 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.logging.view.ui(Maven) | = 4.3.4 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.logging.view.ui(Maven) | = 4.3.5 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.logging.view.ui(Maven) | = 4.3.6 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.logging.view.ui(Maven) | = 4.4.0 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.logging.view.ui(Maven) | = 4.4.1 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.logging.view.ui(Maven) | = 4.4.2 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.logging.view.ui(Maven) | = 4.4.3 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.logging.view.ui(Maven) | = 4.4.4 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.logging.view.ui(Maven) | = 4.4.5 | No fix listed |
| WSO2 carbon | = 4.4.5 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- github.com
- web.archive.org
- 40240 exploit third-party-advisory vdb-entry
- hyp3rlinx.altervista.org exploit third-party-advisory
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 20160813 WSO2-CARBON v4.4.5 LOCAL FILE INCLUSION mailing-list
- 92473 third-party-advisory vdb-entry
- docs.wso2.com patch vendor-advisory
- github.com