Enterprise Integrator vulnerabilities
8 known vulnerabilities in Enterprise Integrator from WSO2. 8 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
WSO2 Open Banking AM: Cross-Site Request Forgery
A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services, specifically in the event processor of the Carbon console. Although the SameSite=Lax c
- 7.2 High severity
WSO2 Micro Integrator: Improper Control of Generation of Code
An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Authenticated users with elevated privileges can execute arbitrary code within the integration run
- 7.2 High severity
WSO2 API Manager: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-co
- 9.1 Critical severity
WSO2 Enterprise Integrator: Improper Restriction of XML External Entity Reference
An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities. A successf
- 7.2 High severity
WSO2 Identity Server: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint. An authenticated attacker with appropriate privileges can upload a malicious file to a user-controlled loc
- 7.2 High severity
WSO2 Enterprise Integrator: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. A malicious actor with administrative privileges can upload arbitrary files to a user-cont
- 7.5 High severity
WSO2 API Manager: Improper Restriction of XML External Entity Reference
Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information.
- 9.8 Critical severity
WSO2 Multiple Products Unrestrictive Upload of File Exploited
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repos