Published: 30th September 2016
WSO2 Dashboard Server 2.0.0
WSO2 Enterprise Mobility Manager 2.0.1
Login page of the “authenticationendpoint” web application of the above mentioned WSO2 Servers is vulnerable to XSS attacks.
Login page hosted in the WSO2 server’s “authenticationendpoint” web application is vulnerable to reflected XSS attacks, which enables attackers to inject client side scripts into that page. The respective page used a weak output encoding mechanism which was not sufficient to escape malicious user inputs properly.
An attacker aware of the authentication endpoint origin can include malicious content in a request to login page and trick a user to click the malicious content via email or a neutral web site. This reflects the attack back to the user’s browser and will execute the injected code, which may generate malicious page results that will mislead the victim or harm otherwise.
Apply the following patch, based on your product versions by following the instructions in the README file. Patches can also be downloaded from http://wso2.com/security-patch-releases/. If you have any questions, please post them to firstname.lastname@example.org.
|DS||WSO2 Dashboard Server||2.0.0||WSO2-CARBON-PATCH-4.4.0-0421|
|EMM||WSO2 Enterprise Mobility Manager||2.0.1|