NVD Vulnerability Detail

CVE-2016-4316

Summary	Multiple cross-site scripting (XSS) vulnerabilities in WSO2 Carbon 4.4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) setName parameter to identity-mgt/challenges-mgt.jsp; the (2) webappType or (3) httpPort parameter to webapp-list/webapp_info.jsp; the (4) dsName or (5) description parameter to ndatasource/newdatasource.jsp; the (6) phase parameter to viewflows/handlers.jsp; or the (7) url parameter to ndatasource/validateconnection-ajaxprocessor.jsp.
Publication Date	Feb. 17, 2017, 11:59 a.m.
Registration Date	Jan. 26, 2021, 2:12 p.m.
Last Update	Nov. 21, 2024, 11:51 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:wso2:carbon:4.4.5:::::::*

Related information, measures and tools

No	URL	タグ
1	http://hyp3rlinx.altervista.org/advisories/WSO2-CARBON-v4.4.5-PERSISTENT-XSS-COOKIE-THEFT.txt	Exploit Third Party Advisory
2	http://hyp3rlinx.altervista.org/advisories/WSO2-CARBON-v4.4.5-PERSISTENT-XSS-COOKIE-THEFT.txt	Exploit Third Party Advisory
3	http://packetstormsecurity.com/files/138331/WSO2-Carbon-4.4.5-Cross-Site-Scripting.html	Exploit Third Party Advisory VDB Entry
4	http://packetstormsecurity.com/files/138331/WSO2-Carbon-4.4.5-Cross-Site-Scripting.html	Exploit Third Party Advisory VDB Entry
5	http://www.securityfocus.com/archive/1/539201/100/0/threaded
6	http://www.securityfocus.com/archive/1/539201/100/0/threaded
7	http://www.securityfocus.com/bid/92473	Third Party Advisory VDB Entry
8	http://www.securityfocus.com/bid/92473	Third Party Advisory VDB Entry
9	https://www.exploit-db.com/exploits/40241/	Exploit Third Party Advisory VDB Entry
10	https://www.exploit-db.com/exploits/40241/	Exploit Third Party Advisory VDB Entry

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html

JVN Vulnerability Information

WSO2 Carbon におけるクロスサイトスクリプティングの脆弱性

Title	WSO2 Carbon におけるクロスサイトスクリプティングの脆弱性
Summary	WSO2 Carbon には、クロスサイトスクリプティングの脆弱性が存在します。
Possible impacts	リモートの攻撃者により、以下のパラメータを介して、任意の Web スクリプトまたは HTML を挿入される可能性があります。 (1) identity-mgt/challenges-mgt.jsp の setName パラメータ (2) webapp-list/webapp_info.jsp の webappType パラメータ (3) webapp-list/webapp_info.jsp の httpPort パラメータ (4) ndatasource/newdatasource.jsp の dsName パラメータ (5) ndatasource/newdatasource.jsp の description パラメータ (6) viewflows/handlers.jsp の phase パラメータ (7) ndatasource/validateconnection-ajaxprocessor.jsp の url パラメータ
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Aug. 12, 2016, midnight
Registration Date	March 6, 2017, 4:32 p.m.
Last Update	March 6, 2017, 4:32 p.m.

Affected System

WSO2

WSO2 Carbon 4.4.5

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-4316	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4316
National Vulnerability Database (NVD)
2	CVE-2016-4316	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4316

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	Name	URL
WSO2
1	Top Page	http://wso2.com/

その他

No	Name	URL
関連文書
1	WSO2 Carbon 4.4.5 Cross Site Scripting	https://packetstormsecurity.com/files/138331/WSO2-Carbon-4.4.5-Cross-Site-Scripting.html

Change Log

No	Changed Details	Date of change
0	[2017年03月06日] 掲載	Feb. 17, 2018, 10:37 a.m.