CVE-2016-4316 WSO2 Carbon vulnerable to Cross-site Scripting

What is CVE-2016-4316?

CVE-2016-4316 is a medium-severity cross-site scripting vulnerability in n/a, published on 16 Feb 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Multiple cross-site scripting (XSS) vulnerabilities in WSO2 Carbon 4.4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) setName parameter to identity-mgt/challenges-mgt.jsp; the (2) webappType or (3) httpPort parameter to webapp-list/webapp_info.jsp; the (4) dsName or (5) description parameter to ndatasource/newdatasource.jsp; the (6) phase parameter to viewflows/handlers.jsp; or the (7) url parameter to ndatasource/validateconnection-ajaxprocessor.jsp.

Weakness: CWE-79

Which versions are affected by CVE-2016-4316?

6 open source packages ship an affected version, including org.wso2.carbon.commons:org.wso2.carbon.messageflows.ui, org.wso2.carbon.commons:org.wso2.carbon.ndatasource.ui and org.wso2.carbon.identity.framework:org.wso2.carbon.identity.mgt.ui. It affects 1 product.

Products include Wso2 Carbon.

How do I fix CVE-2016-4316?

No fix has been published for CVE-2016-4316 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2016-4316 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2016-4316 exists.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in n/a

• CVE-2016-4315 Cross-site request forgery in n/a Medium 5.7
• CVE-2016-4314 WSO2 Carbon directory traversal vulnerability Medium 4.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2vcm-2mcr-wmx7.