2 lines
4.4 KiB
JSON
2 lines
4.4 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WSO2 API Manager","vendor":"WSO2","versions":[{"lessThan":"4.4.0.67","status":"affected","version":"4.4.0","versionType":"custom"},{"lessThan":"4.5.0.52","status":"affected","version":"4.5.0","versionType":"custom"},{"lessThan":"4.6.0.16","status":"affected","version":"4.6.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Traffic Manager","vendor":"WSO2","versions":[{"lessThan":"4.5.0.51","status":"affected","version":"4.5.0","versionType":"custom"},{"lessThan":"4.6.0.16","status":"affected","version":"4.6.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 API Control Plane","vendor":"WSO2","versions":[{"lessThan":"4.5.0.53","status":"affected","version":"4.5.0","versionType":"custom"},{"lessThan":"4.6.0.17","status":"affected","version":"4.6.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Universal Gateway","vendor":"WSO2","versions":[{"lessThan":"4.5.0.52","status":"affected","version":"4.5.0","versionType":"custom"},{"lessThan":"4.6.0.16","status":"affected","version":"4.6.0","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl","product":"WSO2 Carbon API Management Implementation","vendor":"WSO2","versions":[{"lessThan":"9.30.67.156","status":"affected","version":"9.30.67","versionType":"custom"},{"lessThan":"9.31.86.141","status":"affected","version":"9.31.86","versionType":"custom"},{"lessThan":"9.32.147.44","status":"affected","version":"9.32.147","versionType":"custom"},{"lessThanOrEqual":"*","status":"unaffected","version":"9.33.104","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.publisher.v1.common","product":"WSO2 API Manager Publisher REST API V4","vendor":"WSO2","versions":[{"lessThan":"9.30.67.156","status":"affected","version":"9.30.67","versionType":"custom"},{"lessThan":"9.31.86.141","status":"affected","version":"9.31.86","versionType":"custom"},{"lessThan":"9.32.147.44","status":"affected","version":"9.32.147","versionType":"custom"},{"lessThanOrEqual":"*","status":"unaffected","version":"9.33.104","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.api","product":"WSO2 Carbon API Management API","vendor":"WSO2","versions":[{"lessThan":"9.30.67.156","status":"affected","version":"9.30.67","versionType":"custom"},{"lessThanOrEqual":"*","status":"unaffected","version":"9.33.104","versionType":"custom"}]}],"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges.\n\nSuccessful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution."}],"id":"CVE-2026-3418","lastModified":"2026-08-31T20:14:36.250","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":6.0,"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-3418","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-08-07T17:46:58.452271Z","version":"2.0.3"}}]},"published":"2026-08-06T22:17:03.997","references":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5146/"}],"sourceIdentifier":"ed10eef1-636d-4fbe-9993-6890dfa878f8","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary"}]}
|