GHSA-jfgp-q2hg-w285

WSO2 API Manager vulnerable to SSRF

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-13226

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.wso2.am:am-parent	<= 3.0.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this node's entire intranet.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-13226 advisory
https://github.com/wso2/docs-apim/issues/816 web
https://github.com/wso2/product-apim/issues/7677 web
https://docs.wso2.com/display/Security/Security+Advisories web
https://docs.wso2.com/display/Security/WSO2+Security+Vulnerability+Management+Process web
https://github.com/wso2/product-apim package