Vulnerability Report

CVE-2016-4316

Title: Wso2 Carbon Cross-Site Scripting (XSS)

XSS

Proof Of Concept

PoC Available for CVE-2016-4316

CWE Category CWE-79

Published Date Feb 17, 2017

Modified Date May 13, 2026

Exploit Status Available

Score 6.1 CVSS v3.0

Exploit Probability (EPSS)

4.00%

Vulnerability Summary

CVE-2016-4316: Multiple cross-site scripting (XSS) vulnerabilities in WSO2 Carbon 4.4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) setName parameter to identity-mgt/challenges-mgt.jsp; the (2) webappType or (3) httpPort parameter to webapp-list/webapp_info.jsp; the (4) dsName or (5) description parameter to ndatasource/newdatasource.jsp; the (6) phase parameter to viewflows/handlers.jsp; or the (7) url parameter to ndatasource/validateconnection-ajaxprocessor.jsp.

Impacted Vendors

wso2 1

Reference Links

http://hyp3rlinx.altervista.org/advisories/WSO2-CARBON-v4.4.5-PERSISTENT-XSS-COOKIE-THEFT.txt http://packetstormsecurity.com/files/138331/WSO2-Carbon-4.4.5-Cross-Site-Scripting.html http://www.securityfocus.com/archive/1/539201/100/0/threaded http://www.securityfocus.com/bid/92473 https://www.exploit-db.com/exploits/40241/ http://hyp3rlinx.altervista.org/advisories/WSO2-CARBON-v4.4.5-PERSISTENT-XSS-COOKIE-THEFT.txt http://packetstormsecurity.com/files/138331/WSO2-Carbon-4.4.5-Cross-Site-Scripting.html http://www.securityfocus.com/archive/1/539201/100/0/threaded http://www.securityfocus.com/bid/92473 https://www.exploit-db.com/exploits/40241/

CVSS v3.0

Source Entity [email protected]

Severity MEDIUM

6.1

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

4.3

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:M/Au:N/C:N/I:P/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns