Description (CNA)
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| WSO2 / WSO2 API Manager | affected 4.4.0 before 4.4.0.67; affected 4.5.0 before 4.5.0.52; affected 4.6.0 before 4.6.0.16 |
| WSO2 / WSO2 Traffic Manager | affected 4.5.0 before 4.5.0.51; affected 4.6.0 before 4.6.0.16 |
| WSO2 / WSO2 API Control Plane | affected 4.5.0 before 4.5.0.53; affected 4.6.0 before 4.6.0.17 |
| WSO2 / WSO2 Universal Gateway | affected 4.5.0 before 4.5.0.52; affected 4.6.0 before 4.6.0.16 |
| WSO2 / WSO2 Carbon API Management Implementation | affected 9.30.67 before 9.30.67.156; affected 9.31.86 before 9.31.86.141; affected 9.32.147 before 9.32.147.44; unaffected 9.33.104 through * |
| WSO2 / WSO2 API Manager Publisher REST API V4 | affected 9.30.67 before 9.30.67.156; affected 9.31.86 before 9.31.86.141; affected 9.32.147 before 9.32.147.44; unaffected 9.33.104 through * |
| WSO2 / WSO2 Carbon API Management API | affected 9.30.67 before 9.30.67.156; unaffected 9.33.104 through * |
CWE
CWE-434
References
ADP enrichment
No English description supplied.
No references supplied.