Authenticated arbitrary file upload via a System REST API requiring administrator permission.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.2.0.179, 4.3.0.91, 4.4.0.55, 4.5.0.38, 4.6.0.3, and 8 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- WSO2 WSO2 API Manager
From 4.2.0 · fixed in 4.2.0.179; From 4.3.0 · fixed in 4.3.0.91; From 4.4.0 · fixed in 4.4.0.55; From 4.5.0 · fixed in 4.5.0.38; From 4.6.0 · fixed in 4.6.0.3
- WSO2 WSO2 API Control Plane
From 4.5.0 · fixed in 4.5.0.39; From 4.6.0 · fixed in 4.6.0.3
- WSO2 WSO2 Universal Gateway
From 4.5.0 · fixed in 4.5.0.37; From 4.6.0 · fixed in 4.6.0.3
- WSO2 WSO2 Traffic Manager
From 4.5.0 · fixed in 4.5.0.37; From 4.6.0 · fixed in 4.6.0.3
- org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl
From 9.28.116 · fixed in 9.28.116.391; From 9.29.120 · fixed in 9.29.120.210; From 9.30.67 · fixed in 9.30.67.133; From 9.31.86 · fixed in 9.31.86.100; From 9.32.147 · fixed in 9.32.147.2
- org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1Maven
fixed in 9.32.167