CVE-2016-4311 EXPLOIT
8.8
HIGH · CVSS 3.0 · EPSS 3.4% (pctl 88)
Patch early
A public exploit exists.
Description
Cross-site request forgery (CSRF) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 allows remote attackers to hijack the authentication of privileged users for requests that process XACML requests via an entitlement/eval-policy-submit.jsp request.
Scoring
| CVSS | 8.8 (HIGH, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| EPSS | 3.38% — more likely to be exploited than 88% of all CVEs |
| Weakness | CWE-352 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2017-02-17 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| wso2 | identity server |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | WSO2 Identity Server 5.1.0 - Multiple Vulnerabilities | 2016-08-16 |
References
- http://hyp3rlinx.altervista.org/advisories/WSO2-IDENTITY-SERVER-v5.1.0-XML-External-Entity.txt
- http://packetstormsecurity.com/files/138329/WSO2-Identity-Server-5.1.0-XML-Injection.html
- http://www.securityfocus.com/archive/1/539199/100/0/threaded
- http://www.securityfocus.com/bid/92485
- https://www.exploit-db.com/exploits/40239/
- https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2016-0096
- http://hyp3rlinx.altervista.org/advisories/WSO2-IDENTITY-SERVER-v5.1.0-XML-External-Entity.txt
- http://packetstormsecurity.com/files/138329/WSO2-Identity-Server-5.1.0-XML-Injection.html
- http://www.securityfocus.com/archive/1/539199/100/0/threaded
- http://www.securityfocus.com/bid/92485
- https://www.exploit-db.com/exploits/40239/
→ the Explorer · watch your stack · NVD