WSO2 IS as Key Manager 5.7.0 allows web vulnerabilities

Tŭytepa Overview :

An attacker can trick a privileged user while using WSO2 IS as Key Manager

digitately Affected Product(s) :

WSO2 IS as Key Manager 5.7.0

Vulnerability Details :

CVE ID :	CVE-2019-18882
	A reflected XSS attack could be performed in the dashboard user profile by sending an HTTP GET request with harmful request parameters. Further, a stored XSS attack could be performed in the download-userinfo. jag due to an improper Content-Type of the downloading content.
CVE ID :	CVE-2019-18881
	WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile.

Solution :

Apply the following patch based on your product version by following the instructions in the README file. If you have any questions, post them to security@wso2.com.

Please download the relevant patch based on the product you use following the matrix below. The patch can also be downloaded from http://wso2.com/security-patch-releases/.

Code	Product	Version	Patch
IS KM	WSO2 IS as Key Manager	5.7.0	WSO2-CARBON-PATCH-4.4.0-5019

Contact us to get started

CVE-2023-4291 : Frauscher Sensortechnik FDS101 For FAdC 1.4.24 Code Injection

Description Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a remote code execution (RCE)

Learn more

CVE-2023-2163 : Linux Kernel 5.4 BPF kernel/bpf/verifier.c backtrack_insn calculation

Description Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly marked as safe,

Learn more

CVE-2023-42454 : SQLpage Up To 0.11.0 Database Connection String sqlpage/sqlpage.json Information Disclosure

Description SQLpage is a SQL-only webapp builder. Someone using SQLpage versions prior to 0.11.1, whose SQLpage instance is exposed publicly,

Learn more