CVE-2016-4312 — HIGH (7.5) — White Hats Nepal

Vulnerability Description

XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated users with access to XACML features to read arbitrary files, cause a denial of service, conduct server-side request forgery (SSRF) attacks, or have unspecified other impact via a crafted XACML request to entitlement/eval-policy-submit.jsp. NOTE: this issue can be combined with CVE-2016-4311 to exploit the vulnerability without credentials.

CVSS Score

7.5

HIGH

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Wso2	Identity Server	5.1.0

Related Weaknesses (CWE)

CWE-611

References

http://hyp3rlinx.altervista.org/advisories/WSO2-IDENTITY-SERVER-v5.1.0-XML-ExterExploitThird Party Advisory
http://packetstormsecurity.com/files/138329/WSO2-Identity-Server-5.1.0-XML-InjecExploitThird Party AdvisoryVDB Entry
http://www.securityfocus.com/archive/1/539199/100/0/threaded
http://www.securityfocus.com/bid/92485Third Party AdvisoryVDB Entry
https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2016-0096PatchVendor Advisory
https://www.exploit-db.com/exploits/40239/ExploitThird Party AdvisoryVDB Entry
http://hyp3rlinx.altervista.org/advisories/WSO2-IDENTITY-SERVER-v5.1.0-XML-ExterExploitThird Party Advisory
http://packetstormsecurity.com/files/138329/WSO2-Identity-Server-5.1.0-XML-InjecExploitThird Party AdvisoryVDB Entry
http://www.securityfocus.com/archive/1/539199/100/0/threaded
http://www.securityfocus.com/bid/92485Third Party AdvisoryVDB Entry
https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2016-0096PatchVendor Advisory
https://www.exploit-db.com/exploits/40239/ExploitThird Party AdvisoryVDB Entry

FAQ

What is CVE-2016-4312?

CVE-2016-4312 is a vulnerability with a CVSS score of 7.5 (HIGH). XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated users with access to XACML features to r...

How severe is CVE-2016-4312?

CVE-2016-4312 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2016-4312?

Check the references section above for vendor advisories and patch information. Affected products include: Wso2 Identity Server.