||
Skip to end of metadata
Go to start of metadata

Published: 8th November 2016


AFFECTED PRODUCTS

WSO2 API Manager 2.0.0
WSO2 APP Manager 1.2.0
WSO2 Application Server 5.3.0
WSO2 Business process Server 3.6.0,
WSO2 Business Rules Server 2.2.0
WSO2 Complex Event Processor, 4.2.0
WSO2 Data Analytics Server 3.1.0
WSO2 Dashboard Server 2.0.0
WSO2 Data Services Server 3.5.1
WSO2 Enterprise Mobility Manager 3.0.1
WSO2 Enterprise Store 2.1.0
WSO2 Enterprise Service Bus 5.0.0
WSO2 Governance Registry 5.3.0
WSO2 identity Server 5.2.0
WSO2 Message Broker, 3.1.0
WSO2 Machine Learner 1.2.0


OVERVIEW 


Management Console of WSO2 products cache sensitive data in browsers and intermediary proxies.


DESCRIPTION


When a user browses a page where it contains some sensitive data and logout from the management console, still users can go back (by using browser’s Back button) and view that page without login due to browser cache.


IMPACT


Non privileged users can view sensitive information through the management console.


SOLUTION

 For WSO2 Update Manager (WUM) Supported Products

 Please use WUM to update the following products.

 


Code

Product

Version

AM

WSO2 API Manager

2.0.0

DSS

WSO2 Data Services Server

3.5.1

ESB

WSO2 Enterprise Service Bus

5.0.0

IS

WSO2 Identity Server

5.2.0


NOTE : If you are not yet using WUM, you can still update the DSS 3.5.1 product by manually applying the patches referring the below section.

For Other Products

Apply the following patches based on your product version by following the instructions in the README file. If you have any questions, post them to [email protected].

Please download the relevant patches based on the products you use following the matrix below. Patches can also be downloaded from http://wso2.com/security-patch-releases/.

 


Code

Product

Version

Patch

APPM

WSO2 App Manager

1.2.0

WSO2-CARBON-PATCH-4.4.0-0536

AS

WSO2 Application Server

5.3.0

WSO2-CARBON-PATCH-4.4.0-0531

BPS

WSO2 Business Process Server

3.6.0

WSO2-CARBON-PATCH-4.4.0-0537

BRS

WSO2 Business Rules Server

2.2.0

WSO2-CARBON-PATCH-4.4.0-0533

CEP

WSO2 Complex Event Processor

4.2.0

WSO2-CARBON-PATCH-4.4.0-0538

DAS

WSO2 Data Analytics Server

3.1.0

WSO2-CARBON-PATCH-4.4.0-0538

DS

WSO2 Dashboard Server

2.0.0

WSO2-CARBON-PATCH-4.4.0-0533

DSS

WSO2 Data Services Server

3.5.1

WSO2-CARBON-PATCH-4.4.0-0538

EMM

WSO2 Enterprise Mobility Manager

2.0.1

WSO2-CARBON-PATCH-4.4.0-0533

ES

WSO2 Enterprise Store

2.1.0

WSO2-CARBON-PATCH-4.4.0-0536

GREG

WSO2 Governance Registry

5.3.0

WSO2-CARBON-PATCH-4.4.0-0536

MB

WSO2 Message Broker

3.1.0

WSO2-CARBON-PATCH-4.4.0-0533

ML

WSO2 Machine Learner

1.2.0

WSO2-CARBON-PATCH-4.4.0-0538


NOTES


If you are using newer versions of the products than the ones mentioned in the “SOLUTION” section, this vulnerability is fixed. 


Thanks,

WSO2 Team.

  • No labels