| Package | Affected versions | Patched versions |
|---|---|---|
| enterprise integrator | = 6.6.0 | |
| identity server | = 5.10.0= 5.11.0= 6.0.0= 6.1.0 | |
| identity server as key manager | = 5.10.0 | |
| open banking iam | = 2.0.0 |
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. A malicious actor with administrative privileges can upload arbitrary files to a user-controlled location on the server. By leveraging this vulnerability, an attacker can upload a specially crafted payload and achieve remote code execution (RCE), potentially compromising the server and its data.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free