| Package | Affected versions | Patched versions |
|---|---|---|
| org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 | < 9.32.167 | 9.32.167 |
| api control plane | = 4.5.0= 4.6.0 | |
| api manager | = 4.2.0= 4.3.0= 4.4.0= 4.5.0= 4.6.0 | |
| traffic manager | = 4.5.0= 4.6.0 | |
| universal gateway | = 4.5.0= 4.6.0 |
A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution.
By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free