CVE-2016-4316 WSO2 Carbon vulnerable to Cross-site Scripting
MediumCVSS 6.1
EPSS 4.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in WSO2 Carbon 4.4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) setName parameter to identity-mgt/challenges-mgt.jsp; the (2) webappType or (3) httpPort parameter to webapp-list/webapp_info.jsp; the (4) dsName or (5) description parameter to ndatasource/newdatasource.jsp; the (6) phase parameter to viewflows/handlers.jsp; or the (7) url parameter to ndatasource/validateconnection-ajaxprocessor.jsp.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.wso2.carbon.commons/org.wso2.carbon.ndatasource.ui(Maven) | <= 4.4.5 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.ndatasource.ui(Maven) | = 4.3.0 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.ndatasource.ui(Maven) | = 4.3.1 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.ndatasource.ui(Maven) | = 4.3.2 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.ndatasource.ui(Maven) | = 4.3.3 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.ndatasource.ui(Maven) | = 4.3.4 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.ndatasource.ui(Maven) | = 4.3.5 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.ndatasource.ui(Maven) | = 4.3.6 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.ndatasource.ui(Maven) | = 4.4.0 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.ndatasource.ui(Maven) | = 4.4.1 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.ndatasource.ui(Maven) | = 4.4.2 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.ndatasource.ui(Maven) | = 4.4.3 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.ndatasource.ui(Maven) | = 4.4.4 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.ndatasource.ui(Maven) | = 4.4.5 | No fix listed |
| org.wso2.carbon.identity.framework/org.wso2.carbon.identity.mgt.ui(Maven) | <= 4.4.5 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.messageflows.ui(Maven) | <= 4.4.5 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.messageflows.ui(Maven) | = 4.3.0 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.messageflows.ui(Maven) | = 4.3.1 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.messageflows.ui(Maven) | = 4.3.2 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.messageflows.ui(Maven) | = 4.3.3 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.messageflows.ui(Maven) | = 4.3.4 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.messageflows.ui(Maven) | = 4.3.5 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.messageflows.ui(Maven) | = 4.3.6 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.messageflows.ui(Maven) | = 4.4.0 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.messageflows.ui(Maven) | = 4.4.1 | No fix listed |
Show 5 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.wso2.carbon.commons/org.wso2.carbon.messageflows.ui(Maven) | = 4.4.2 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.messageflows.ui(Maven) | = 4.4.3 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.messageflows.ui(Maven) | = 4.4.4 | No fix listed |
| org.wso2.carbon.commons/org.wso2.carbon.messageflows.ui(Maven) | = 4.4.5 | No fix listed |
| WSO2 carbon | = 4.4.5 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- web.archive.org
- 40241 exploit third-party-advisory vdb-entry
- hyp3rlinx.altervista.org exploit third-party-advisory
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 20160813 WSO2 CARBON v4.4.5 PERSISTENT XSS COOKIE THEFT mailing-list
- 92473 third-party-advisory vdb-entry
- github.com