Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated users with access to XACML features to read arbitrary files, cause a denial of service, conduct server-side request forgery (SSRF) attacks, or have unspecified other impact via a crafted XACML request to entitlement/eval-policy-submit.jsp. NOTE: this issue can be combined with CVE-2016-4311 to exploit the vulnerability without credentials.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
WSO2 Identity Server 安全漏洞
Vulnerability Description
WSO2 Identity Server是美国WSO2公司的一个开源的身份认证服务，它支持Information Cards、OpenID和XACML身份识别框架。 WSO2 Identity Server WSO2-CARBON-PATCH-4.4.0-0231之前的5.1.0版本中的XACML flow功能存在XML外部实体注入漏洞。远程攻击者可通过向entitlement/eval-policy-submit.jsp文件发送特制的XACML请求利用该漏洞造成拒绝服务。
CVSS Information
N/A
Vulnerability Type
N/A