Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution

Summary

The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server. Successful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server with the privileges of the WSO2 product. This could lead to a full compromise of the system.

Affected versions

• WSO2 WSO2 Enterprise Integrator

  From 6.6.0 · fixed in 6.6.0.204

• WSO2 WSO2 API Manager

  From 3.1.0 · fixed in 3.1.0.275; From 3.2.0 · fixed in 3.2.0.365; From 3.2.1 · fixed in 3.2.1.19; From 4.0.0 · fixed in 4.0.0.308; From 4.1.0 · fixed in 4.1.0.170; From 4.2.0 · fixed in 4.2.0.107; From 4.3.0 · fixed in 4.3.0.21

• WSO2 WSO2 Open Banking AM

  From 2.0.0 · fixed in 2.0.0.325

• WSO2 WSO2 Open Banking IAM

  From 2.0.0 · fixed in 2.0.0.345

• WSO2 WSO2 Identity Server as Key Manager

  From 5.10.0 · fixed in 5.10.0.292

• WSO2 WSO2 Identity Server

  From 5.10.0 · fixed in 5.10.0.296; From 5.11.0 · fixed in 5.11.0.336; From 6.0.0 · fixed in 6.0.0.188; From 6.1.0 · fixed in 6.1.0.148; From 7.0.0 · fixed in 7.0.0.15

• org.wso2.carbon:org.wso2.carbon.user.core

  From 4.5.0 · fixed in 4.5.0.4; From 4.5.3 · fixed in 4.5.3.34; From 4.6.0 · fixed in 4.6.0.141; From 4.6.1 · fixed in 4.6.1.108; From 4.6.2 · fixed in 4.6.2.610; From 4.6.3 · fixed in 4.6.3.23; From 4.6.4 · fixed in 4.6.4.5; From 4.7.1 · fixed in 4.7.1.51; From 4.8.1 · fixed in 4.8.1.23; From 4.9.0 · fixed in 4.9.0.54; From 4.9.26 · fixed in 4.9.26.13; From 4.10.9 · fixed in 4.10.9.10

References 2